CVE-2020-13249

libmariadb/mariadb_lib.c in MariaDB Connector/C before 3.1.8 does not properly validate the content of an OK packet received from a server. NOTE: although mariadb_lib.c was originally based on code shipped for MySQL, this issue does not affect any MySQL components supported by Oracle.

libmariadb/mariadb_lib.c in MariaDB Connector/C before 3.1.8 does not properly validate the content of an OK packet received from a server. NOTE: although mariadb_lib.c was originally based on code shipped for MySQL, this issue does not affect any MySQL components supported by Oracle.

MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL.

The following packages have been upgraded to a later upstream version: mariadb (10.3.27), galera (25.3.31). (BZ#1899082, BZ#1899086)

Security Fix(es):

• mariadb: Insufficient SST method name check leading to code injection in mysql-wsrep (CVE-2020-15180)

• mysql: InnoDB unspecified vulnerability (CPU Oct 2019) (CVE-2019-2938)

• mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2019) (CVE-2019-2974)

• mysql: C API unspecified vulnerability (CPU Apr 2020) (CVE-2020-2752)

• mysql: InnoDB unspecified vulnerability (CPU Apr 2020) (CVE-2020-2760)

• mysql: Server: DML unspecified vulnerability (CPU Apr 2020) (CVE-2020-2780)

• mysql: Server: Stored Procedure unspecified vulnerability (CPU Apr 2020) (CVE-2020-2812)

• mysql: InnoDB unspecified vulnerability (CPU Apr 2020) (CVE-2020-2814)

• mariadb-connector-c: Improper validation of content in a OK packet received from server (CVE-2020-13249)

• mysql: Server: FTS unspecified vulnerability (CPU Oct 2020) (CVE-2020-14765)

• mysql: InnoDB unspecified vulnerability (CPU Oct 2020) (CVE-2020-14776)

• mysql: Server: FTS unspecified vulnerability (CPU Oct 2020) (CVE-2020-14789)

• mysql: Server: Locking unspecified vulnerability (CPU Oct 2020) (CVE-2020-14812)

• mysql: C API unspecified vulnerability (CPU Jan 2020) (CVE-2020-2574)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• FTBFS: -D_GLIBCXX_ASSERTIONS (BZ#1899009)

• Queries with entity_id IN ('1', '2', …, '70000') run much slower in MariaDB 10.3 than on MariaDB 10.1 (BZ#1899017)

• Cleanup race with wsrep_rsync_sst_tunnel may prevent full galera cluster bootstrap (BZ#1899021)

• There are undeclared file conflicts in several mariadb and mysql packages (BZ#1899077)

The MariaDB Native Client library (C driver) is used to connect applications developed in C/C++ to MariaDB and MySQL databases.

The following packages have been upgraded to a later upstream version: mariadb-connector-c (3.1.11). (BZ#1898993)

Security Fix(es):

• mysql: C API unspecified vulnerability (CPU Apr 2020) (CVE-2020-2752)

• mysql: C API unspecified vulnerability (CPU Apr 2020) (CVE-2020-2922)

• mariadb-connector-c: Improper validation of content in a OK packet received from server (CVE-2020-13249)

• mysql: C API unspecified vulnerability (CPU Jan 2020) (CVE-2020-2574)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• Code utilizing plugins can't be compiled properly (BZ#1899001)

• Add "zlib-devel" requirement in "-devel" subpackage (BZ#1899005)

• Replace hard-coded /usr with %{_prefix} (BZ#1899099)

libmariadb/mariadb_lib.c in MariaDB Connector/C before 3.1.8 does not properly validate the content of an OK packet received from a server. NOTE: although mariadb_lib.c was originally based on code shipped for MySQL, this issue does not affect any MySQL components supported by Oracle.

MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL.

The following packages have been upgraded to a later upstream version: mariadb (10.3.27), galera (25.3.31). (BZ#1899082, BZ#1899086)

Security Fix(es):

• mariadb: Insufficient SST method name check leading to code injection in mysql-wsrep (CVE-2020-15180)

• mysql: InnoDB unspecified vulnerability (CPU Oct 2019) (CVE-2019-2938)

• mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2019) (CVE-2019-2974)

• mysql: C API unspecified vulnerability (CPU Apr 2020) (CVE-2020-2752)

• mysql: InnoDB unspecified vulnerability (CPU Apr 2020) (CVE-2020-2760)

• mysql: Server: DML unspecified vulnerability (CPU Apr 2020) (CVE-2020-2780)

• mysql: Server: Stored Procedure unspecified vulnerability (CPU Apr 2020) (CVE-2020-2812)

• mysql: InnoDB unspecified vulnerability (CPU Apr 2020) (CVE-2020-2814)

• mariadb-connector-c: Improper validation of content in a OK packet received from server (CVE-2020-13249)

• mysql: Server: FTS unspecified vulnerability (CPU Oct 2020) (CVE-2020-14765)

• mysql: InnoDB unspecified vulnerability (CPU Oct 2020) (CVE-2020-14776)

• mysql: Server: FTS unspecified vulnerability (CPU Oct 2020) (CVE-2020-14789)

• mysql: Server: Locking unspecified vulnerability (CPU Oct 2020) (CVE-2020-14812)

• mysql: C API unspecified vulnerability (CPU Jan 2020) (CVE-2020-2574)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• FTBFS: -D_GLIBCXX_ASSERTIONS (BZ#1899009)

• Queries with entity_id IN ('1', '2', …, '70000') run much slower in MariaDB 10.3 than on MariaDB 10.1 (BZ#1899017)

• Cleanup race with wsrep_rsync_sst_tunnel may prevent full galera cluster bootstrap (BZ#1899021)

• There are undeclared file conflicts in several mariadb and mysql packages (BZ#1899077)

The MariaDB Native Client library (C driver) is used to connect applications developed in C/C++ to MariaDB and MySQL databases.

The following packages have been upgraded to a later upstream version: mariadb-connector-c (3.1.11). (BZ#1898993)

Security Fix(es):

• mysql: C API unspecified vulnerability (CPU Apr 2020) (CVE-2020-2752)

• mysql: C API unspecified vulnerability (CPU Apr 2020) (CVE-2020-2922)

• mariadb-connector-c: Improper validation of content in a OK packet received from server (CVE-2020-13249)

• mysql: C API unspecified vulnerability (CPU Jan 2020) (CVE-2020-2574)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• Code utilizing plugins can't be compiled properly (BZ#1899001)

• Add "zlib-devel" requirement in "-devel" subpackage (BZ#1899005)

• Replace hard-coded /usr with %{_prefix} (BZ#1899099)

This update for mariadb-connector-c fixes the following issues:

Security issue fixed:

• CVE-2020-13249: Fixed an improper validation of OK packets received from clients (bsc#1171550).

Non-security issues fixed:

• Update to release 3.1.8 (bsc#1171550)
  • CONC-304: Rename the static library to libmariadb.a and other libmariadb files in a consistent manner
  • CONC-441: Default user name for C/C is wrong if login user is different from effective user
  • CONC-449: Check $MARIADB_HOME/my.cnf in addition to $MYSQL_HOME/my.cnf
  • CONC-457: mysql_list_processes crashes in unpack_fields
  • CONC-458: mysql_get_timeout_value crashes when used improper
  • CONC-464: Fix static build for auth_gssapi_client plugin

This update was imported from the SUSE:SLE-15:Update update project.

This update for mariadb to version 10.2.32 fixes the following issues:

mariadb was updated to version 10.2.32 (bsc#1171550)

• CVE-2020-2752: Fixed an issue which could have resulted in unauthorized ability to cause denial of service.
• CVE-2020-2812: Fixed an issue which could have resulted in unauthorized ability to cause denial of service.
• CVE-2020-2814: Fixed an issue which could have resulted in unauthorized ability to cause denial of service.
• CVE-2020-2760: Fixed an issue which could have resulted in unauthorized ability to cause denial of service.
• CVE-2020-13249: Fixed an improper validation of the content of an OK packet received from a server.

Release notes and changelog:

• https://mariadb.com/kb/en/library/mariadb-10232-release-notes
• https://mariadb.com/kb/en/library/mariadb-10232-changelog

This update was imported from the SUSE:SLE-15:Update update project.

These are all security issues fixed in the libmariadbd-devel-10.6.4-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the libmariadb-devel-3.2.3-2.2 package on the GA media of openSUSE Tumbleweed.

This update for mariadb104 fixes the following issues:

• Implement version 10.4 of MariaDB (jsc#PED-2455):
  • It is possible to use more than one authentication plugin for each user account.
  • The root user account is being created with the ability to use two authentication plugins.
  • All user accounts, passwords, and global privileges are now stored in the mysql.global_priv table.
  • Is being supported for User Password Expiry, which is not active by default.
  • Faster privilege checks for MariaDB setups with many user accounts or many database grants.
• Update mysql-systemd-helper to be aware of custom group (bsc#1200105)
• MariaDB is now support lz4 compression for 'INNODB'. (bsc#1186031)
• Add 'mysql-user.conf' file to enable systemd generating mysql user in containers. (bsc#1173028)
• Fixes an issue when MariaDB is ignoring the value of the parameter 'open_files_limit' in the global variables. (bsc#1180014)

This update for mariadb104 fixes the following issues:

• Implement version 10.4 of MariaDB (jsc#PED-2455):
  • It is possible to use more than one authentication plugin for each user account.
  • The root user account is being created with the ability to use two authentication plugins.
  • All user accounts, passwords, and global privileges are now stored in the mysql.global_priv table.
  • Is being supported for User Password Expiry, which is not active by default.
  • Faster privilege checks for MariaDB setups with many user accounts or many database grants.
• Update mysql-systemd-helper to be aware of custom group (bsc#1200105)
• MariaDB is now support lz4 compression for 'INNODB'. (bsc#1186031)
• Add 'mysql-user.conf' file to enable systemd generating mysql user in containers. (bsc#1173028)
• Fixes an issue when MariaDB is ignoring the value of the parameter 'open_files_limit' in the global variables. (bsc#1180014)

This update for mariadb-connector-c fixes the following issues:

Security issue fixed:

• CVE-2020-13249: Fixed an improper validation of OK packets received from clients (bsc#1171550).

Non-security issues fixed:

• Update to release 3.1.8 (bsc#1171550)
  • CONC-304: Rename the static library to libmariadb.a and other libmariadb files in a consistent manner
  • CONC-441: Default user name for C/C is wrong if login user is different from effective user
  • CONC-449: Check $MARIADB_HOME/my.cnf in addition to $MYSQL_HOME/my.cnf
  • CONC-457: mysql_list_processes crashes in unpack_fields
  • CONC-458: mysql_get_timeout_value crashes when used improper
  • CONC-464: Fix static build for auth_gssapi_client plugin

This update for mariadb-connector-c fixes the following issues:

Security issue fixed:

• CVE-2020-13249: Fixed an improper validation of OK packets received from clients (bsc#1171550).

Non-security issues fixed:

• Update to release 3.1.8 (bsc#1171550)
  • CONC-304: Rename the static library to libmariadb.a and other libmariadb files in a consistent manner
  • CONC-441: Default user name for C/C is wrong if login user is different from effective user
  • CONC-449: Check $MARIADB_HOME/my.cnf in addition to $MYSQL_HOME/my.cnf
  • CONC-457: mysql_list_processes crashes in unpack_fields
  • CONC-458: mysql_get_timeout_value crashes when used improper
  • CONC-464: Fix static build for auth_gssapi_client plugin

This update for mariadb fixes the following issues:

mariadb was updated to version 10.2.32 (bsc#1171550)

• CVE-2020-2752: Fixed an issue which could have resulted in unauthorized ability to cause denial of service.
• CVE-2020-2812: Fixed an issue which could have resulted in unauthorized ability to cause denial of service.
• CVE-2020-2814: Fixed an issue which could have resulted in unauthorized ability to cause denial of service.
• CVE-2020-2760: Fixed an issue which could have resulted in unauthorized ability to cause denial of service.
• CVE-2020-13249: Fixed an improper validation of the content of an OK packet received from a server.

Release notes and changelog:

• https://mariadb.com/kb/en/library/mariadb-10232-release-notes
• https://mariadb.com/kb/en/library/mariadb-10232-changelog
• Update to 10.2.32 GA [bsc#1171550]

This update for mariadb to version 10.2.32 fixes the following issues:

mariadb was updated to version 10.2.32 (bsc#1171550)

• CVE-2020-2752: Fixed an issue which could have resulted in unauthorized ability to cause denial of service.
• CVE-2020-2812: Fixed an issue which could have resulted in unauthorized ability to cause denial of service.
• CVE-2020-2814: Fixed an issue which could have resulted in unauthorized ability to cause denial of service.
• CVE-2020-2760: Fixed an issue which could have resulted in unauthorized ability to cause denial of service.
• CVE-2020-13249: Fixed an improper validation of the content of an OK packet received from a server.

Release notes and changelog:

• https://mariadb.com/kb/en/library/mariadb-10232-release-notes
• https://mariadb.com/kb/en/library/mariadb-10232-changelog

This update for mariadb includes the following fixes:

Security fixes included in this update:

• CVE-2020-2752: Fixed an issue which could have resulted in unauthorized ability to cause denial of service.
• CVE-2020-2812: Fixed an issue which could have resulted in unauthorized ability to cause denial of service.
• CVE-2020-2814: Fixed an issue which could have resulted in unauthorized ability to cause denial of service.
• CVE-2020-2760: Fixed an issue which could have resulted in unauthorized ability to cause denial of service.
• CVE-2020-13249: Fixed an improper validation of the content of an OK packet received from a server.
• CVE-2020-14812: Fixed an issue which could have resulted in unauthorized ability to cause denial of service.
• CVE-2020-14765: Fixed an issue which could have resulted in unauthorized ability to cause denial of service.
• CVE-2020-14776: Fixed an issue which could have resulted in unauthorized ability of accessing data.
• CVE-2020-14789: Fixed an issue which could have resulted in unauthorized ability to cause denial of service.
• CVE-2020-15180: Fixed an issue in Galera which could have led to remote code execution.

Non Security fixes included in this update:

• Update to 10.2.36 GA [bsc#1177472] and [bsc#1178428]

  • release notes and changelog: https://mariadb.com/kb/en/library/mariadb-10236-release-notes https://mariadb.com/kb/en/library/mariadb-10236-changelog https://mariadb.com/kb/en/library/mariadb-10235-release-notes https://mariadb.com/kb/en/library/mariadb-10235-changelog https://mariadb.com/kb/en/library/mariadb-10234-release-notes https://mariadb.com/kb/en/library/mariadb-10234-changelog
  • fixes for the following security vulnerabilities: 10.2.36: none 10.2.35: CVE-2020-14812, CVE-2020-14765, CVE-2020-14776, CVE-2020-14789 10.2.34: CVE-2020-15180

• update suse_skipped_tests.list

• Update to 10.2.33 GA [bsc#1175596]

  • release notes and changelog: https://mariadb.com/kb/en/library/mariadb-10233-release-notes https://mariadb.com/kb/en/library/mariadb-10233-changelog
  • fixes for the following security vulnerabilities: none

• refresh mariadb-10.2.4-fortify-and-O.patch

• tune the testsuite to avoid randomly failing tests

• update suse_skipped_tests.list

• Update to 10.2.32 GA [bsc#1171550]

  • Fixes for the following security vulnerabilities: CVE-2020-2752, CVE-2020-2812, CVE-2020-2814, CVE-2020-2760, CVE-2020-13249
  • release notes and changelog: https://mariadb.com/kb/en/library/mariadb-10232-release-notes https://mariadb.com/kb/en/library/mariadb-10232-changelog

• refresh mariadb-10.2.4-fortify-and-O.patch

• drop specfile 'hacks' as things work correctly in upstream now:

  • renaming tmpfiles.conf -> mariadb.conf
  • installing pam_user_map.so to /lib64/security for non 32bit architectures
  • sysusers.conf was renamed to mariadb.conf

• update suse_skipped_tests.list

It was discovered that MariaDB didn't properly validate the content of a packet received from a server. A remote attacker could use this vulnerability to sent a specialy crafted file to cause a denial of service. (CVE-2020-13249)

It was discovered that MariaDB has other security issues. An attacker can cause a hang or frequently repeatable crash (denial of service). (CVE-2020-15180, CVE-2020-2752, CVE-2020-2760, CVE-2020-2812, CVE-2020-2814)

In addition to security fixes, the updated packages contain bug fixes, new features, and possibly incompatible changes.