Read the docs
TI-2017-07641 Aliases CVE-2017-10294GHSA-6vf9-w2pm-g56x

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server…

Priority LOW 26Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and Red Hat.

Summary

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 5.6.37 and earlier and 5.7.19 and earlier. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01563 75th percentileScored 2026-11-07
Fix Fixed Red Hat: 2 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
OracleMySQL Serverup to 5.6.37; up to 5.7.19—No fix listedCNA
  • MySQL Server VendorOracle Affected up to 5.6.37; up to 5.7.19 Fixed in — No fix listed CNA

CPE configurations NVD · 53

CPEVersionsRoleVendor
cpe:2.3:a:oracle:mysql:5.6.0:*:*:*:*:*:*:*5.6.0VulnerableOracle
cpe:2.3:a:oracle:mysql:5.6.1:*:*:*:*:*:*:*5.6.1VulnerableOracle
cpe:2.3:a:oracle:mysql:5.6.2:*:*:*:*:*:*:*5.6.2VulnerableOracle
cpe:2.3:a:oracle:mysql:5.6.3:*:*:*:*:*:*:*5.6.3VulnerableOracle
cpe:2.3:a:oracle:mysql:5.6.4:*:*:*:*:*:*:*5.6.4VulnerableOracle
cpe:2.3:a:oracle:mysql:5.6.5:*:*:*:*:*:*:*5.6.5VulnerableOracle
cpe:2.3:a:oracle:mysql:5.6.6:*:*:*:*:*:*:*5.6.6VulnerableOracle
cpe:2.3:a:oracle:mysql:5.6.7:*:*:*:*:*:*:*5.6.7VulnerableOracle
cpe:2.3:a:oracle:mysql:5.6.8:*:*:*:*:*:*:*5.6.8VulnerableOracle
cpe:2.3:a:oracle:mysql:5.6.9:*:*:*:*:*:*:*5.6.9VulnerableOracle
  • cpe:2.3:a:oracle:mysql:5.6.0:*:*:*:*:*:*:* Versions 5.6.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.6.1:*:*:*:*:*:*:* Versions 5.6.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.6.2:*:*:*:*:*:*:* Versions 5.6.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.6.3:*:*:*:*:*:*:* Versions 5.6.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.6.4:*:*:*:*:*:*:* Versions 5.6.4 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.6.5:*:*:*:*:*:*:* Versions 5.6.5 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.6.6:*:*:*:*:*:*:* Versions 5.6.6 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.6.7:*:*:*:*:*:*:* Versions 5.6.7 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.6.8:*:*:*:*:*:*:* Versions 5.6.8 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.6.9:*:*:*:*:*:*:* Versions 5.6.9 Vulnerable ·Oracle
Show 43 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:oracle:mysql:5.6.10:*:*:*:*:*:*:*5.6.10VulnerableOracle
cpe:2.3:a:oracle:mysql:5.6.11:*:*:*:*:*:*:*5.6.11VulnerableOracle
cpe:2.3:a:oracle:mysql:5.6.12:*:*:*:*:*:*:*5.6.12VulnerableOracle
cpe:2.3:a:oracle:mysql:5.6.13:*:*:*:*:*:*:*5.6.13VulnerableOracle
cpe:2.3:a:oracle:mysql:5.6.14:*:*:*:*:*:*:*5.6.14VulnerableOracle
cpe:2.3:a:oracle:mysql:5.6.15:*:*:*:*:*:*:*5.6.15VulnerableOracle
cpe:2.3:a:oracle:mysql:5.6.16:*:*:*:*:*:*:*5.6.16VulnerableOracle
cpe:2.3:a:oracle:mysql:5.6.17:*:*:*:*:*:*:*5.6.17VulnerableOracle
cpe:2.3:a:oracle:mysql:5.6.21:*:*:*:*:*:*:*5.6.21VulnerableOracle
cpe:2.3:a:oracle:mysql:5.6.22:*:*:*:*:*:*:*5.6.22VulnerableOracle
cpe:2.3:a:oracle:mysql:5.6.23:*:*:*:*:*:*:*5.6.23VulnerableOracle
cpe:2.3:a:oracle:mysql:5.6.26:*:*:*:*:*:*:*5.6.26VulnerableOracle
cpe:2.3:a:oracle:mysql:5.6.27:*:*:*:*:*:*:*5.6.27VulnerableOracle
cpe:2.3:a:oracle:mysql:5.6.28:*:*:*:*:*:*:*5.6.28VulnerableOracle
cpe:2.3:a:oracle:mysql:5.6.29:*:*:*:*:*:*:*5.6.29VulnerableOracle
cpe:2.3:a:oracle:mysql:5.6.30:*:*:*:*:*:*:*5.6.30VulnerableOracle
cpe:2.3:a:oracle:mysql:5.6.31:*:*:*:*:*:*:*5.6.31VulnerableOracle
cpe:2.3:a:oracle:mysql:5.6.32:*:*:*:*:*:*:*5.6.32VulnerableOracle
cpe:2.3:a:oracle:mysql:5.6.33:*:*:*:*:*:*:*5.6.33VulnerableOracle
cpe:2.3:a:oracle:mysql:5.6.34:*:*:*:*:*:*:*5.6.34VulnerableOracle
cpe:2.3:a:oracle:mysql:5.6.35:*:*:*:*:*:*:*5.6.35VulnerableOracle
cpe:2.3:a:oracle:mysql:5.6.36:*:*:*:*:*:*:*5.6.36VulnerableOracle
cpe:2.3:a:oracle:mysql:5.6.37:*:*:*:*:*:*:*5.6.37VulnerableOracle
cpe:2.3:a:oracle:mysql:5.7.0:*:*:*:*:*:*:*5.7.0VulnerableOracle
cpe:2.3:a:oracle:mysql:5.7.1:*:*:*:*:*:*:*5.7.1VulnerableOracle
cpe:2.3:a:oracle:mysql:5.7.2:*:*:*:*:*:*:*5.7.2VulnerableOracle
cpe:2.3:a:oracle:mysql:5.7.3:*:*:*:*:*:*:*5.7.3VulnerableOracle
cpe:2.3:a:oracle:mysql:5.7.4:*:*:*:*:*:*:*5.7.4VulnerableOracle
cpe:2.3:a:oracle:mysql:5.7.5:*:*:*:*:*:*:*5.7.5VulnerableOracle
cpe:2.3:a:oracle:mysql:5.7.6:*:*:*:*:*:*:*5.7.6VulnerableOracle
cpe:2.3:a:oracle:mysql:5.7.7:*:*:*:*:*:*:*5.7.7VulnerableOracle
cpe:2.3:a:oracle:mysql:5.7.8:*:*:*:*:*:*:*5.7.8VulnerableOracle
cpe:2.3:a:oracle:mysql:5.7.9:*:*:*:*:*:*:*5.7.9VulnerableOracle
cpe:2.3:a:oracle:mysql:5.7.10:*:*:*:*:*:*:*5.7.10VulnerableOracle
cpe:2.3:a:oracle:mysql:5.7.11:*:*:*:*:*:*:*5.7.11VulnerableOracle
cpe:2.3:a:oracle:mysql:5.7.12:*:*:*:*:*:*:*5.7.12VulnerableOracle
cpe:2.3:a:oracle:mysql:5.7.13:*:*:*:*:*:*:*5.7.13VulnerableOracle
cpe:2.3:a:oracle:mysql:5.7.14:*:*:*:*:*:*:*5.7.14VulnerableOracle
cpe:2.3:a:oracle:mysql:5.7.15:*:*:*:*:*:*:*5.7.15VulnerableOracle
cpe:2.3:a:oracle:mysql:5.7.16:*:*:*:*:*:*:*5.7.16VulnerableOracle
cpe:2.3:a:oracle:mysql:5.7.17:*:*:*:*:*:*:*5.7.17VulnerableOracle
cpe:2.3:a:oracle:mysql:5.7.18:*:*:*:*:*:*:*5.7.18VulnerableOracle
cpe:2.3:a:oracle:mysql:5.7.19:*:*:*:*:*:*:*5.7.19VulnerableOracle
  • cpe:2.3:a:oracle:mysql:5.6.10:*:*:*:*:*:*:* Versions 5.6.10 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.6.11:*:*:*:*:*:*:* Versions 5.6.11 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.6.12:*:*:*:*:*:*:* Versions 5.6.12 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.6.13:*:*:*:*:*:*:* Versions 5.6.13 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.6.14:*:*:*:*:*:*:* Versions 5.6.14 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.6.15:*:*:*:*:*:*:* Versions 5.6.15 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.6.16:*:*:*:*:*:*:* Versions 5.6.16 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.6.17:*:*:*:*:*:*:* Versions 5.6.17 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.6.21:*:*:*:*:*:*:* Versions 5.6.21 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.6.22:*:*:*:*:*:*:* Versions 5.6.22 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.6.23:*:*:*:*:*:*:* Versions 5.6.23 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.6.26:*:*:*:*:*:*:* Versions 5.6.26 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.6.27:*:*:*:*:*:*:* Versions 5.6.27 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.6.28:*:*:*:*:*:*:* Versions 5.6.28 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.6.29:*:*:*:*:*:*:* Versions 5.6.29 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.6.30:*:*:*:*:*:*:* Versions 5.6.30 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.6.31:*:*:*:*:*:*:* Versions 5.6.31 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.6.32:*:*:*:*:*:*:* Versions 5.6.32 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.6.33:*:*:*:*:*:*:* Versions 5.6.33 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.6.34:*:*:*:*:*:*:* Versions 5.6.34 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.6.35:*:*:*:*:*:*:* Versions 5.6.35 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.6.36:*:*:*:*:*:*:* Versions 5.6.36 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.6.37:*:*:*:*:*:*:* Versions 5.6.37 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.7.0:*:*:*:*:*:*:* Versions 5.7.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.7.1:*:*:*:*:*:*:* Versions 5.7.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.7.2:*:*:*:*:*:*:* Versions 5.7.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.7.3:*:*:*:*:*:*:* Versions 5.7.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.7.4:*:*:*:*:*:*:* Versions 5.7.4 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.7.5:*:*:*:*:*:*:* Versions 5.7.5 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.7.6:*:*:*:*:*:*:* Versions 5.7.6 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.7.7:*:*:*:*:*:*:* Versions 5.7.7 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.7.8:*:*:*:*:*:*:* Versions 5.7.8 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.7.9:*:*:*:*:*:*:* Versions 5.7.9 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.7.10:*:*:*:*:*:*:* Versions 5.7.10 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.7.11:*:*:*:*:*:*:* Versions 5.7.11 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.7.12:*:*:*:*:*:*:* Versions 5.7.12 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.7.13:*:*:*:*:*:*:* Versions 5.7.13 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.7.14:*:*:*:*:*:*:* Versions 5.7.14 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.7.15:*:*:*:*:*:*:* Versions 5.7.15 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.7.16:*:*:*:*:*:*:* Versions 5.7.16 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.7.17:*:*:*:*:*:*:* Versions 5.7.17 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.7.18:*:*:*:*:*:*:* Versions 5.7.18 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.7.19:*:*:*:*:*:*:* Versions 5.7.19 Vulnerable ·Oracle

Remediation

Red Hat 2 advisories

  • RHSA-2017:3442 Released 2017-12-12 · Red Hat rating Important
    rh-mysql57-mysql security update
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) rh-mysql57-mysql-5.7.20-1.el6, rh-mysql57-mysql-common-5.7.20-1.el6, rh-mysql57-mysql-config-5.7.20-1.el6 +4
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-mysql57-mysql-5.7.20-1.el7, rh-mysql57-mysql-common-5.7.20-1.el7, rh-mysql57-mysql-config-5.7.20-1.el7 +4
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7) rh-mysql57-mysql-5.7.20-1.el6, rh-mysql57-mysql-common-5.7.20-1.el6, rh-mysql57-mysql-config-5.7.20-1.el6 +4
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3) rh-mysql57-mysql-5.7.20-1.el7, rh-mysql57-mysql-common-5.7.20-1.el7, rh-mysql57-mysql-config-5.7.20-1.el7 +4
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4) rh-mysql57-mysql-5.7.20-1.el7, rh-mysql57-mysql-common-5.7.20-1.el7, rh-mysql57-mysql-config-5.7.20-1.el7 +4
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) rh-mysql57-mysql-5.7.20-1.el6, rh-mysql57-mysql-common-5.7.20-1.el6, rh-mysql57-mysql-config-5.7.20-1.el6 +4
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-mysql57-mysql-5.7.20-1.el7, rh-mysql57-mysql-common-5.7.20-1.el7, rh-mysql57-mysql-config-5.7.20-1.el7 +4
  • RHSA-2017:3265 Released 2017-11-27 · Red Hat rating Important
    rh-mysql56-mysql security update
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) rh-mysql56-mysql-5.6.38-1.el6, rh-mysql56-mysql-bench-5.6.38-1.el6, rh-mysql56-mysql-common-5.6.38-1.el6 +5
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-mysql56-mysql-5.6.38-1.el7, rh-mysql56-mysql-bench-5.6.38-1.el7, rh-mysql56-mysql-common-5.6.38-1.el7 +5
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7) rh-mysql56-mysql-5.6.38-1.el6, rh-mysql56-mysql-bench-5.6.38-1.el6, rh-mysql56-mysql-common-5.6.38-1.el6 +5
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3) rh-mysql56-mysql-5.6.38-1.el7, rh-mysql56-mysql-bench-5.6.38-1.el7, rh-mysql56-mysql-common-5.6.38-1.el7 +5
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4) rh-mysql56-mysql-5.6.38-1.el7, rh-mysql56-mysql-bench-5.6.38-1.el7, rh-mysql56-mysql-common-5.6.38-1.el7 +5
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) rh-mysql56-mysql-5.6.38-1.el6, rh-mysql56-mysql-bench-5.6.38-1.el6, rh-mysql56-mysql-common-5.6.38-1.el6 +5
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-mysql56-mysql-5.6.38-1.el7, rh-mysql56-mysql-bench-5.6.38-1.el7, rh-mysql56-mysql-common-5.6.38-1.el7 +5

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Oracle MySQL Server — RHSA-2017:3442

    18 records Highest priority Priority MEDIUM 1 MEDIUM, 17 LOW

    Other records, highest priority first

    • TI-2017-07506 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server…Priority MEDIUM 46
    • TI-2017-07717 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server…Priority LOW 35
    • TI-2017-07627 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: FTS).Priority LOW 35
  • Advisory ·

    Oracle MySQL Server — RHSA-2017:3265

    10 records Highest priority Priority MEDIUM 1 MEDIUM, 9 LOW

    Other records, highest priority first

    • TI-2017-07506 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server…Priority MEDIUM 46
    • TI-2017-07717 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server…Priority LOW 35
    • TI-2017-07627 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: FTS).Priority LOW 35

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)Fixed RHSA-2017:3265, RHSA-2017:3442
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2017:3265, RHSA-2017:3442
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)Fixed RHSA-2017:3265, RHSA-2017:3442
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3)Fixed RHSA-2017:3265, RHSA-2017:3442
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4)Fixed RHSA-2017:3265, RHSA-2017:3442
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)Fixed RHSA-2017:3265, RHSA-2017:3442
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2017:3265, RHSA-2017:3442
Not affected: 11 products
  • Red Hat Enterprise Linux 5
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux OpenStack Platform 6 (Juno)
  • Red Hat Enterprise Linux OpenStack Platform 7 (Kilo)
  • Red Hat OpenStack Platform 10 (Newton)
  • Red Hat OpenStack Platform 11 (Ocata)
  • Red Hat OpenStack Platform 12 (Pike)
  • Red Hat OpenStack Platform 8 (Liberty)
  • Red Hat OpenStack Platform 9 (Mitaka)
  • Red Hat Software Collections

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-10294
  2. 2026-10-03 Alias added: GHSA-6vf9-w2pm-g56x

References

  • TI-2017-02794 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server… CVSS 3.0HIGH 7.5
  • TI-2016-05707 Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB… CVSS 3.0CRITICAL 9.8
  • TI-2003-00723 Buffer overflow in get_salt_from_password from sql_acl.cc for MySQL 4.0.14 and earlier… CVSS 2.0HIGH 9.0
  • TI-2020-04444 RFD Attack via "Content-Disposition" Header Sourced from Request Input by Spring MVC or Spring WebFlux Application CVSS 3.1HIGH 7.5
  • TI-2008-00208 Multiple buffer overflows in yaSSL 1.7.5 and earlier, as used in MySQL and possibly other… CVSS 2.0HIGH 7.5
  • TI-2020-01888 Segmentation fault in SSL_check_chain CVSS 3.1HIGH 7.5
See all 1327 →

Sources