TI-2014-01592 Aliases CVE-2014-2029 GHSA-8ch9-48h9-cqjf

The automatic version check functionality in the tools in Percona Toolkit 2.1 allows…

LOW 39CWE-200Published 2017-09-28 · Updated 2024-08-06

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: Information disclosure
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-200.

Summary

The automatic version check functionality in the tools in Percona Toolkit 2.1 allows man-in-the-middle attackers to obtain sensitive information or execute arbitrary code by leveraging use of HTTP to download configuration information from v.percona.com.

Why it matters now

EPSS 0.0198 80th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:percona:toolkit:2.1:::::::*	2.1	Vulnerable	Percona

cpe:2.3:a:percona:toolkit:2.1:*:*:*:*:*:*:* Versions 2.1 Vulnerable ·Percona

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2014-2029
2026-10-03 Alias added: GHSA-8ch9-48h9-cqjf

References

Patch 1

https://bugzilla.novell.com/show_bug.cgi?id=864194

Advisory 2

TI-2015-00929 The version checking subroutine in percona-toolkit before 2.2.13 and xtrabackup before… CVSS 3.0MEDIUM 5.9
TI-2024-07140 Misuse of SHA256 to create an encryption key CVSS 4.0MEDIUM 5.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences