CVE-2019-2938

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.27 and prior and 8.0.17 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).

MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon (mysqld) and many client programs and libraries.

The following packages have been upgraded to a later upstream version: mysql (8.0.21).

Security Fix(es):

• mysql: Server: Security: Privileges multiple unspecified vulnerabilities (CVE-2020-14663, CVE-2020-14678, CVE-2020-14697, CVE-2020-2761, CVE-2020-2774, CVE-2020-2779, CVE-2020-2853, CVE-2020-14586, CVE-2020-14702)

• mysql: Server: Security: Encryption multiple unspecified vulnerabilities (CVE-2019-2914, CVE-2019-2957)

• mysql: InnoDB multiple unspecified vulnerabilities (CVE-2019-2938, CVE-2019-2963, CVE-2019-2968, CVE-2019-3018, CVE-2020-2577, CVE-2020-2589, CVE-2020-2760, CVE-2020-2762, CVE-2020-2814, CVE-2020-2893, CVE-2020-2895, CVE-2020-14568, CVE-2020-14623, CVE-2020-14633, CVE-2020-14634)

• mysql: Server: PS multiple unspecified vulnerabilities (CVE-2019-2946, CVE-2020-2925)

• mysql: Server: Replication multiple unspecified vulnerabilities (CVE-2019-2960, CVE-2020-2759, CVE-2020-2763, CVE-2020-14567)

• mysql: Server: Optimizer multiple unspecified vulnerabilities (CVE-2019-2966, CVE-2019-2967, CVE-2019-2974, CVE-2019-2982, CVE-2019-2991, CVE-2019-2998, CVE-2020-2579, CVE-2020-2660, CVE-2020-2679, CVE-2020-2686, CVE-2020-2765, CVE-2020-2892, CVE-2020-2897, CVE-2020-2901, CVE-2020-2904, CVE-2020-2923, CVE-2020-2924, CVE-2020-2928, CVE-2020-14539, CVE-2020-14547, CVE-2020-14597, CVE-2020-14614, CVE-2020-14654, CVE-2020-14680, CVE-2020-14725)

• mysql: Server: C API multiple unspecified vulnerabilities (CVE-2019-2993, CVE-2019-3011)

• mysql: Server: DDL multiple unspecified vulnerabilities (CVE-2019-2997, CVE-2020-2580)

• mysql: Server: Parser multiple unspecified vulnerabilities (CVE-2019-3004, CVE-2020-2627, CVE-2020-2930, CVE-2020-14619)

• mysql: Server: Connection unspecified vulnerability (CVE-2019-3009)

• mysql: Server: Options multiple unspecified vulnerabilities (CVE-2020-2584, CVE-2020-14632)

• mysql: Server: DML multiple unspecified vulnerabilities (CVE-2020-2588, CVE-2020-2780, CVE-2020-14540, CVE-2020-14575, CVE-2020-14620)

• mysql: C API multiple unspecified vulnerabilities (CVE-2020-2752, CVE-2020-2922, CVE-2020-14550, CVE-2020-2570, CVE-2020-2573, CVE-2020-2574)

• mysql: Server: Logging unspecified vulnerability (CVE-2020-2770)

• mysql: Server: Memcached unspecified vulnerability (CVE-2020-2804)

• mysql: Server: Stored Procedure unspecified vulnerability (CVE-2020-2812)

• mysql: Server: Information Schema multiple unspecified vulnerabilities (CVE-2020-2896, CVE-2020-14559, CVE-2020-2694)

• mysql: Server: Charsets unspecified vulnerability (CVE-2020-2898)

• mysql: Server: Connection Handling unspecified vulnerability (CVE-2020-2903)

• mysql: Server: Group Replication Plugin unspecified vulnerability (CVE-2020-2921)

• mysql: Server: Group Replication GCS unspecified vulnerability (CVE-2020-2926)

• mysql: Server: Pluggable Auth unspecified vulnerability (CVE-2020-14553)

• mysql: Server: UDF unspecified vulnerability (CVE-2020-14576)

• mysql: Server: JSON unspecified vulnerability (CVE-2020-14624)

• mysql: Server: Security: Audit unspecified vulnerability (CVE-2020-14631)

• mysql: Server: Security: Roles multiple unspecified vulnerabilities (CVE-2020-14641, CVE-2020-14643, CVE-2020-14651)

• mysql: Server: Locking unspecified vulnerability (CVE-2020-14656)

• mysql: Information Schema unspecified vulnerability (CVE-2019-2911)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL.

The following packages have been upgraded to a later upstream version: mariadb (10.3.27), galera (25.3.31). (BZ#1899082, BZ#1899086)

Security Fix(es):

• mariadb: Insufficient SST method name check leading to code injection in mysql-wsrep (CVE-2020-15180)

• mysql: InnoDB unspecified vulnerability (CPU Oct 2019) (CVE-2019-2938)

• mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2019) (CVE-2019-2974)

• mysql: C API unspecified vulnerability (CPU Apr 2020) (CVE-2020-2752)

• mysql: InnoDB unspecified vulnerability (CPU Apr 2020) (CVE-2020-2760)

• mysql: Server: DML unspecified vulnerability (CPU Apr 2020) (CVE-2020-2780)

• mysql: Server: Stored Procedure unspecified vulnerability (CPU Apr 2020) (CVE-2020-2812)

• mysql: InnoDB unspecified vulnerability (CPU Apr 2020) (CVE-2020-2814)

• mariadb-connector-c: Improper validation of content in a OK packet received from server (CVE-2020-13249)

• mysql: Server: FTS unspecified vulnerability (CPU Oct 2020) (CVE-2020-14765)

• mysql: InnoDB unspecified vulnerability (CPU Oct 2020) (CVE-2020-14776)

• mysql: Server: FTS unspecified vulnerability (CPU Oct 2020) (CVE-2020-14789)

• mysql: Server: Locking unspecified vulnerability (CPU Oct 2020) (CVE-2020-14812)

• mysql: C API unspecified vulnerability (CPU Jan 2020) (CVE-2020-2574)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• FTBFS: -D_GLIBCXX_ASSERTIONS (BZ#1899009)

• Queries with entity_id IN ('1', '2', …, '70000') run much slower in MariaDB 10.3 than on MariaDB 10.1 (BZ#1899017)

• Cleanup race with wsrep_rsync_sst_tunnel may prevent full galera cluster bootstrap (BZ#1899021)

• There are undeclared file conflicts in several mariadb and mysql packages (BZ#1899077)

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.27 and prior and 8.0.17 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).

MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon (mysqld) and many client programs and libraries.

The following packages have been upgraded to a later upstream version: mysql (8.0.21).

Security Fix(es):

• mysql: Server: Security: Privileges multiple unspecified vulnerabilities (CVE-2020-14663, CVE-2020-14678, CVE-2020-14697, CVE-2020-2761, CVE-2020-2774, CVE-2020-2779, CVE-2020-2853, CVE-2020-14586, CVE-2020-14702)

• mysql: Server: Security: Encryption multiple unspecified vulnerabilities (CVE-2019-2914, CVE-2019-2957)

• mysql: InnoDB multiple unspecified vulnerabilities (CVE-2019-2938, CVE-2019-2963, CVE-2019-2968, CVE-2019-3018, CVE-2020-2577, CVE-2020-2589, CVE-2020-2760, CVE-2020-2762, CVE-2020-2814, CVE-2020-2893, CVE-2020-2895, CVE-2020-14568, CVE-2020-14623, CVE-2020-14633, CVE-2020-14634)

• mysql: Server: PS multiple unspecified vulnerabilities (CVE-2019-2946, CVE-2020-2925)

• mysql: Server: Replication multiple unspecified vulnerabilities (CVE-2019-2960, CVE-2020-2759, CVE-2020-2763, CVE-2020-14567)

• mysql: Server: Optimizer multiple unspecified vulnerabilities (CVE-2019-2966, CVE-2019-2967, CVE-2019-2974, CVE-2019-2982, CVE-2019-2991, CVE-2019-2998, CVE-2020-2579, CVE-2020-2660, CVE-2020-2679, CVE-2020-2686, CVE-2020-2765, CVE-2020-2892, CVE-2020-2897, CVE-2020-2901, CVE-2020-2904, CVE-2020-2923, CVE-2020-2924, CVE-2020-2928, CVE-2020-14539, CVE-2020-14547, CVE-2020-14597, CVE-2020-14614, CVE-2020-14654, CVE-2020-14680, CVE-2020-14725)

• mysql: Server: C API multiple unspecified vulnerabilities (CVE-2019-2993, CVE-2019-3011)

• mysql: Server: DDL multiple unspecified vulnerabilities (CVE-2019-2997, CVE-2020-2580)

• mysql: Server: Parser multiple unspecified vulnerabilities (CVE-2019-3004, CVE-2020-2627, CVE-2020-2930, CVE-2020-14619)

• mysql: Server: Connection unspecified vulnerability (CVE-2019-3009)

• mysql: Server: Options multiple unspecified vulnerabilities (CVE-2020-2584, CVE-2020-14632)

• mysql: Server: DML multiple unspecified vulnerabilities (CVE-2020-2588, CVE-2020-2780, CVE-2020-14540, CVE-2020-14575, CVE-2020-14620)

• mysql: C API multiple unspecified vulnerabilities (CVE-2020-2752, CVE-2020-2922, CVE-2020-14550, CVE-2020-2570, CVE-2020-2573, CVE-2020-2574)

• mysql: Server: Logging unspecified vulnerability (CVE-2020-2770)

• mysql: Server: Memcached unspecified vulnerability (CVE-2020-2804)

• mysql: Server: Stored Procedure unspecified vulnerability (CVE-2020-2812)

• mysql: Server: Information Schema multiple unspecified vulnerabilities (CVE-2020-2896, CVE-2020-14559, CVE-2020-2694)

• mysql: Server: Charsets unspecified vulnerability (CVE-2020-2898)

• mysql: Server: Connection Handling unspecified vulnerability (CVE-2020-2903)

• mysql: Server: Group Replication Plugin unspecified vulnerability (CVE-2020-2921)

• mysql: Server: Group Replication GCS unspecified vulnerability (CVE-2020-2926)

• mysql: Server: Pluggable Auth unspecified vulnerability (CVE-2020-14553)

• mysql: Server: UDF unspecified vulnerability (CVE-2020-14576)

• mysql: Server: JSON unspecified vulnerability (CVE-2020-14624)

• mysql: Server: Security: Audit unspecified vulnerability (CVE-2020-14631)

• mysql: Server: Security: Roles multiple unspecified vulnerabilities (CVE-2020-14641, CVE-2020-14643, CVE-2020-14651)

• mysql: Server: Locking unspecified vulnerability (CVE-2020-14656)

• mysql: Information Schema unspecified vulnerability (CVE-2019-2911)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL.

The following packages have been upgraded to a later upstream version: mariadb (10.3.27), galera (25.3.31). (BZ#1899082, BZ#1899086)

Security Fix(es):

• mariadb: Insufficient SST method name check leading to code injection in mysql-wsrep (CVE-2020-15180)

• mysql: InnoDB unspecified vulnerability (CPU Oct 2019) (CVE-2019-2938)

• mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2019) (CVE-2019-2974)

• mysql: C API unspecified vulnerability (CPU Apr 2020) (CVE-2020-2752)

• mysql: InnoDB unspecified vulnerability (CPU Apr 2020) (CVE-2020-2760)

• mysql: Server: DML unspecified vulnerability (CPU Apr 2020) (CVE-2020-2780)

• mysql: Server: Stored Procedure unspecified vulnerability (CPU Apr 2020) (CVE-2020-2812)

• mysql: InnoDB unspecified vulnerability (CPU Apr 2020) (CVE-2020-2814)

• mariadb-connector-c: Improper validation of content in a OK packet received from server (CVE-2020-13249)

• mysql: Server: FTS unspecified vulnerability (CPU Oct 2020) (CVE-2020-14765)

• mysql: InnoDB unspecified vulnerability (CPU Oct 2020) (CVE-2020-14776)

• mysql: Server: FTS unspecified vulnerability (CPU Oct 2020) (CVE-2020-14789)

• mysql: Server: Locking unspecified vulnerability (CPU Oct 2020) (CVE-2020-14812)

• mysql: C API unspecified vulnerability (CPU Jan 2020) (CVE-2020-2574)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• FTBFS: -D_GLIBCXX_ASSERTIONS (BZ#1899009)

• Queries with entity_id IN ('1', '2', …, '70000') run much slower in MariaDB 10.3 than on MariaDB 10.1 (BZ#1899017)

• Cleanup race with wsrep_rsync_sst_tunnel may prevent full galera cluster bootstrap (BZ#1899021)

• There are undeclared file conflicts in several mariadb and mysql packages (BZ#1899077)

Updated mariadb packages fix security vulnerabilities:

A vulnerability in Server: Optimizer contains an easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise the server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) (CVE-2019-2974).

A vulnerability in InnoDB contains an Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise the server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) (CVE-2019-2938).

This update for mariadb to version 10.2.29 fixes the following issues:

MariaDB was updated to 10.2.29 (bsc#1156669)

Security issues fixed:

• CVE-2019-2737: Fixed an issue where could lead a remote attacker to cause denial of service
• CVE-2019-2938: Fixed an issue where could lead a remote attacker to cause denial of service
• CVE-2019-2740: Fixed an issue where could lead a local attacker to cause denial of service
• CVE-2019-2805: Fixed an issue where could lead a local attacker to cause denial of service
• CVE-2019-2974: Fixed an issue where could lead a remote attacker to cause denial of service
• CVE-2019-2758: Fixed an issue where could lead a local attacker to cause denial of service or data corruption
• CVE-2019-2739: Fixed an issue where could lead a local attacker to cause denial of service or data corruption

This update was imported from the SUSE:SLE-15:Update update project.

This update for mariadb104 fixes the following issues:

• Implement version 10.4 of MariaDB (jsc#PED-2455):
  • It is possible to use more than one authentication plugin for each user account.
  • The root user account is being created with the ability to use two authentication plugins.
  • All user accounts, passwords, and global privileges are now stored in the mysql.global_priv table.
  • Is being supported for User Password Expiry, which is not active by default.
  • Faster privilege checks for MariaDB setups with many user accounts or many database grants.
• Update mysql-systemd-helper to be aware of custom group (bsc#1200105)
• MariaDB is now support lz4 compression for 'INNODB'. (bsc#1186031)
• Add 'mysql-user.conf' file to enable systemd generating mysql user in containers. (bsc#1173028)
• Fixes an issue when MariaDB is ignoring the value of the parameter 'open_files_limit' in the global variables. (bsc#1180014)

This update for mariadb104 fixes the following issues:

• Implement version 10.4 of MariaDB (jsc#PED-2455):
  • It is possible to use more than one authentication plugin for each user account.
  • The root user account is being created with the ability to use two authentication plugins.
  • All user accounts, passwords, and global privileges are now stored in the mysql.global_priv table.
  • Is being supported for User Password Expiry, which is not active by default.
  • Faster privilege checks for MariaDB setups with many user accounts or many database grants.
• Update mysql-systemd-helper to be aware of custom group (bsc#1200105)
• MariaDB is now support lz4 compression for 'INNODB'. (bsc#1186031)
• Add 'mysql-user.conf' file to enable systemd generating mysql user in containers. (bsc#1173028)
• Fixes an issue when MariaDB is ignoring the value of the parameter 'open_files_limit' in the global variables. (bsc#1180014)

This update for mariadb to version 10.2.29 fixes the following issues:

MariaDB was updated to 10.2.29 (bsc#1156669)

Security issues fixed:

• CVE-2019-2737: Fixed an issue where could lead a remote attacker to cause denial of service
• CVE-2019-2938: Fixed an issue where could lead a remote attacker to cause denial of service
• CVE-2019-2740: Fixed an issue where could lead a local attacker to cause denial of service
• CVE-2019-2805: Fixed an issue where could lead a local attacker to cause denial of service
• CVE-2019-2974: Fixed an issue where could lead a remote attacker to cause denial of service
• CVE-2019-2758: Fixed an issue where could lead a local attacker to cause denial of service or data corruption
• CVE-2019-2739: Fixed an issue where could lead a local attacker to cause denial of service or data corruption

This update for mariadb to version 10.2.29 fixes the following issues:

MariaDB was updated to 10.2.29 (bsc#1156669)

Security issues fixed:

• CVE-2019-2737: Fixed an issue where could lead a remote attacker to cause denial of service
• CVE-2019-2938: Fixed an issue where could lead a remote attacker to cause denial of service
• CVE-2019-2740: Fixed an issue where could lead a local attacker to cause denial of service
• CVE-2019-2805: Fixed an issue where could lead a local attacker to cause denial of service
• CVE-2019-2974: Fixed an issue where could lead a remote attacker to cause denial of service
• CVE-2019-2758: Fixed an issue where could lead a local attacker to cause denial of service or data corruption
• CVE-2019-2739: Fixed an issue where could lead a local attacker to cause denial of service or data corruption

This update for ardana-cinder, ardana-cobbler, ardana-designate, ardana-extensions-example, ardana-extensions-nsx, ardana-glance, ardana-heat, ardana-input-model, ardana-ironic, ardana-keystone, ardana-logging, ardana-monasca, ardana-monasca-transform, ardana-mq, ardana-neutron, ardana-nova, ardana-octavia, ardana-osconfig, ardana-tempest, crowbar-core, crowbar-ha, crowbar-openstack, crowbar-ui, keepalived, mariadb, openstack-cinder, openstack-dashboard, openstack-dashboard-theme-SUSE, openstack-heat, openstack-heat-templates, openstack-horizon-plugin-designate-ui, openstack-horizon-plugin-neutron-lbaas-ui, openstack-ironic, openstack-keystone, openstack-monasca-agent, openstack-neutron, openstack-neutron-gbp, openstack-neutron-vsphere, openstack-nova, openstack-octavia, openstack-octavia-amphora-image, openstack-resource-agents, openstack-sahara, openstack-trove, python-cinderlm, python-congressclient, python-designateclient, python-ironic-lib, python-networking-cisco, python-osc-lib, python-oslo.context, python-oslo.rootwrap, python-oslo.serialization, python-oslo.service, python-stevedore, python-taskflow, rubygem-crowbar-client, rubygem-puma, venv-openstack-swift fixes the following issues: Security issues fixed:

The update of rubygem-crowbar-client, rubygem-puma fixes the following security issues:

• CVE-2018-17954: Fixed an issue where crowbar was leaking the secret admin passwords to all nodes (bsc#1117080).
• CVE-2019-16770: Fixed a denial-of-service vulnerability that was exploitable by clients sending extraneous keepalive requests (bsc#1158675).

The update of mariadb to 10.2.29 fixes several security issues:

• CVE-2020-2574: Fixed a difficult to exploit vulnerability that allowed an attacker to crash the client (bsc#1162388).
• CVE-2019-18901: Fixed a difficult to exploit vulnerability that allowed an attacker to crash the client (bsc#1162388).
• CVE-2017-1002201: Fixed an issue where special characters did not escpae properly (bsc#1155089)
• CVE-2019-2737, CVE-2019-2739, CVE-2019-2740, CVE-2019-2758, CVE-2019-2805, CVE-2019-2938, CVE-2019-2974: Fixed an issue where could lead a remote attacker to cause denial of service (bsc#1156669)

Non-security issues fixed:

Changes in ardana-cinder:

• Update to version 8.0+git.1579279939.ee7da88:

  • Add option to flatten snapshots when using SES (SOC-11054)

• Update to version 8.0+git.1571846011.1a2f62b:

  • SCRD-4764 move v2.0 endpoints to v3 (SOC-9753)

Changes in ardana-cobbler:

• Update to version 8.0+git.1575037115.0326803:
  • Set root device on SLES autoyast templates (SOC-7365)

Changes in ardana-designate:

• Update to version 8.0+git.1573597788.15b7984:
  • Update gerrit location (SOC-9140)

Changes in ardana-extensions-example:

• Switch to new Gerrit Server

• Update to version 8.0+git.1534266307.db1ec28:

  • SCPL-409 Fix .gitreview for stable/pike

Changes in ardana-extensions-nsx:

• Update to version 8.0+git.1567529036.a41a037:

  • Update policy json templates for vmware-nsx (SOC-10254)

• Switch to new Gerrit Server

Changes in ardana-glance:

• Update to version 8.0+git.1571846045.ab9e3ea:
  • SCRD-4764 move v2.0 endpoints to v3 (SOC-9753)

Changes in ardana-heat:

• Update to version 8.0+git.1571777596.14dce6a:
  • SCRD-4764 remove V2.0 auth end points (SOC-9753)

Changes in ardana-input-model:

• Update to version 8.0+git.1582147997.b9ed134:

  • Enable port security extension neutron (SOC-11027)

• Update to version 8.0+git.1573658751.38e822a:

  • Move manila share to controller (SOC-10938)

Changes in ardana-ironic:

• Update to version 8.0+git.1571845225.006843d:
  • SCRD-4764 remove V2.0 auth end points (SOC-9753)

Changes in ardana-keystone:

• Update to version 8.0+git.1573147067.09e3ea0:
  • enable debug and insecure_debug on demand (SOC-10934)

Changes in ardana-logging:

• Update to version 8.0+git.1572452293.e65d714:
  • use correct Keystone v3 params bsc#1117840 (SOC-9753)

Changes in ardana-monasca:

• Update to version 8.0+git.1572527728.9b34bdf: *…

This update for mariadb to version 10.2.31 GA fixes the following issues:

MariaDB was updated to version 10.2.31 GA (bsc#1162388 and bsc#1156669).

Security issues fixed:

• CVE-2020-2574: Fixed a difficult to exploit vulnerability that allowed an attacker to crash the client (bsc#1162388).
• CVE-2019-18901: Fixed an unsafe path handling behavior in mysql-systemd-helper (bsc#1160895).
• CVE-2019-2737: Fixed an issue where could lead a remote attacker to cause denial of service
• CVE-2019-2938: Fixed an issue where could lead a remote attacker to cause denial of service
• CVE-2019-2740: Fixed an issue where could lead a local attacker to cause denial of service
• CVE-2019-2805: Fixed an issue where could lead a local attacker to cause denial of service
• CVE-2019-2974: Fixed an issue where could lead a remote attacker to cause denial of service
• CVE-2019-2758: Fixed an issue where could lead a local attacker to cause denial of service or data corruption
• CVE-2019-2739: Fixed an issue where could lead a local attacker to cause denial of service or data corruption
• Enabled security hardenings in MariaDB's systemd service, namely ProtectSystem, ProtectHome and UMask (bsc#1160878).
• Fixed a potental symlink attack (bsc#1160912).
• Fixed a permissions issue in /var/lib/mysql (bsc#1077717).
• Used systemd-tmpfiles for a cleaner and safer creation of /run/mysql (bsc#1160883).

Multiple security issues were discovered in MySQL and this update includes new upstream MySQL versions to fix these issues.

MySQL has been updated to 8.0.18 in Ubuntu 19.10. Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 19.04 have been updated to MySQL 5.7.28.

In addition to security fixes, the updated packages contain bug fixes, new features, and possibly incompatible changes.

Please see the following for more information: https://dev.mysql.com/doc/relnotes/mysql/5.7/en/news-5-7-28.html https://dev.mysql.com/doc/relnotes/mysql/8.0/en/news-8-0-18.html https://www.oracle.com/security-alerts/cpuoct2019.html

USN-4195-1 fixed multiple vulnerabilities in MySQL. This update provides the corresponding fixes for CVE-2019-2974 in MariaDB 10.1 and CVE-2019-2938, CVE-2019-2974 for MariaDB 10.3.

Ubuntu 18.04 LTS has been updated to MariaDB 10.1.43. Ubuntu 19.04 and 19.10 has been updated to MariaDB 10.3.20.

In addition to security fixes, the updated package contain bug fixes, new features, and possibly incompatible changes.

Please see the following for more information: https://mariadb.com/kb/en/library/mariadb-10143-changelog/ https://mariadb.com/kb/en/library/mariadb-10143-release-notes/ https://mariadb.com/kb/en/library/mariadb-10320-changelog/ https://mariadb.com/kb/en/library/mariadb-10320-release-notes/

Original advisory details:

Multiple security issues were discovered in MySQL and this update includes new upstream MySQL versions to fix these issues.

MySQL has been updated to 8.0.18 in Ubuntu 19.10. Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 19.04 have been updated to MySQL 5.7.28.

In addition to security fixes, the updated packages contain bug fixes, new features, and possibly incompatible changes.

Please see the following for more information: https://dev.mysql.com/doc/relnotes/mysql/5.7/en/news-5-7-28.html https://dev.mysql.com/doc/relnotes/mysql/8.0/en/news-8-0-18.html https://www.oracle.com/security-alerts/cpuoct2019.html