CVE-2020-15180

A flaw was found in the mysql-wsrep component of mariadb. Lack of input sanitization in wsrep_sst_method allows for command injection that can be exploited by a remote attacker to execute arbitrary commands on galera cluster nodes. This threatens the system's confidentiality, integrity, and availability. This flaw affects mariadb versions before 10.1.47, before 10.2.34, before 10.3.25, before 10.4.15 and before 10.5.6.

MariaDB turns data into structured information in a wide array of applications, ranging from banking to websites. It is an enhanced, drop-in replacement for MySQL. MariaDB is used because it is fast, scalable and robust, with a rich ecosystem of storage engines, plugins and many other tools make it very versatile for a wide variety of use cases.

Security Fix(es):

A remote code execution issue was discovered in MariaDB 10.2 before 10.2.37, 10.3 before 10.3.28, 10.4 before 10.4.18, and 10.5 before 10.5.9; Percona Server through 2021-03-03; and the wsrep patch through 2021-03-03 for MySQL. An untrusted search path leads to eval injection, in which a database SUPER user can execute OS commands after modifying wsrep_provider and wsrep_notify_cmd. NOTE: this does not affect an Oracle product.(CVE-2021-27928)

A flaw was found in the mysql-wsrep component of mariadb. Lack of input sanitization in wsrep_sst_method allows for command injection that can be exploited by a remote attacker to execute arbitrary commands on galera cluster nodes. This threatens the system's confidentiality, integrity, and availability. This flaw affects mariadb versions before 10.1.47, before 10.2.34, before 10.3.25, before 10.4.15 and before 10.5.6.(CVE-2020-15180)

MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL.

The following packages have been upgraded to a later upstream version: mariadb (10.3.27), galera (25.3.31). (BZ#1899082, BZ#1899086)

Security Fix(es):

• mariadb: Insufficient SST method name check leading to code injection in mysql-wsrep (CVE-2020-15180)

• mysql: InnoDB unspecified vulnerability (CPU Oct 2019) (CVE-2019-2938)

• mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2019) (CVE-2019-2974)

• mysql: C API unspecified vulnerability (CPU Apr 2020) (CVE-2020-2752)

• mysql: InnoDB unspecified vulnerability (CPU Apr 2020) (CVE-2020-2760)

• mysql: Server: DML unspecified vulnerability (CPU Apr 2020) (CVE-2020-2780)

• mysql: Server: Stored Procedure unspecified vulnerability (CPU Apr 2020) (CVE-2020-2812)

• mysql: InnoDB unspecified vulnerability (CPU Apr 2020) (CVE-2020-2814)

• mariadb-connector-c: Improper validation of content in a OK packet received from server (CVE-2020-13249)

• mysql: Server: FTS unspecified vulnerability (CPU Oct 2020) (CVE-2020-14765)

• mysql: InnoDB unspecified vulnerability (CPU Oct 2020) (CVE-2020-14776)

• mysql: Server: FTS unspecified vulnerability (CPU Oct 2020) (CVE-2020-14789)

• mysql: Server: Locking unspecified vulnerability (CPU Oct 2020) (CVE-2020-14812)

• mysql: C API unspecified vulnerability (CPU Jan 2020) (CVE-2020-2574)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• FTBFS: -D_GLIBCXX_ASSERTIONS (BZ#1899009)

• Queries with entity_id IN ('1', '2', …, '70000') run much slower in MariaDB 10.3 than on MariaDB 10.1 (BZ#1899017)

• Cleanup race with wsrep_rsync_sst_tunnel may prevent full galera cluster bootstrap (BZ#1899021)

• There are undeclared file conflicts in several mariadb and mysql packages (BZ#1899077)

A flaw was found in the mysql-wsrep component of mariadb. Lack of input sanitization in wsrep_sst_method allows for command injection that can be exploited by a remote attacker to execute arbitrary commands on galera cluster nodes. This threatens the system's confidentiality, integrity, and availability. This flaw affects mariadb versions before 10.1.47, before 10.2.34, before 10.3.25, before 10.4.15 and before 10.5.6.

MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL.

The following packages have been upgraded to a later upstream version: mariadb (10.3.27), galera (25.3.31). (BZ#1899082, BZ#1899086)

Security Fix(es):

• mariadb: Insufficient SST method name check leading to code injection in mysql-wsrep (CVE-2020-15180)

• mysql: InnoDB unspecified vulnerability (CPU Oct 2019) (CVE-2019-2938)

• mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2019) (CVE-2019-2974)

• mysql: C API unspecified vulnerability (CPU Apr 2020) (CVE-2020-2752)

• mysql: InnoDB unspecified vulnerability (CPU Apr 2020) (CVE-2020-2760)

• mysql: Server: DML unspecified vulnerability (CPU Apr 2020) (CVE-2020-2780)

• mysql: Server: Stored Procedure unspecified vulnerability (CPU Apr 2020) (CVE-2020-2812)

• mysql: InnoDB unspecified vulnerability (CPU Apr 2020) (CVE-2020-2814)

• mariadb-connector-c: Improper validation of content in a OK packet received from server (CVE-2020-13249)

• mysql: Server: FTS unspecified vulnerability (CPU Oct 2020) (CVE-2020-14765)

• mysql: InnoDB unspecified vulnerability (CPU Oct 2020) (CVE-2020-14776)

• mysql: Server: FTS unspecified vulnerability (CPU Oct 2020) (CVE-2020-14789)

• mysql: Server: Locking unspecified vulnerability (CPU Oct 2020) (CVE-2020-14812)

• mysql: C API unspecified vulnerability (CPU Jan 2020) (CVE-2020-2574)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• FTBFS: -D_GLIBCXX_ASSERTIONS (BZ#1899009)

• Queries with entity_id IN ('1', '2', …, '70000') run much slower in MariaDB 10.3 than on MariaDB 10.1 (BZ#1899017)

• Cleanup race with wsrep_rsync_sst_tunnel may prevent full galera cluster bootstrap (BZ#1899021)

• There are undeclared file conflicts in several mariadb and mysql packages (BZ#1899077)

A flaw was found in the mysql-wsrep component of mariadb. Lack of input sanitization in wsrep_sst_method allows for command injection that can be exploited by a remote attacker to execute arbitrary commands on galera cluster nodes. This threatens the system's confidentiality, integrity, and availability. This flaw affects mariadb versions before 10.1.47, before 10.2.34, before 10.3.25, before 10.4.15 and before 10.5.6.

A flaw was found in the mysql-wsrep component of mariadb. Lack of input sanitization in wsrep_sst_method allows for command injection that can be exploited by a remote attacker to execute arbitrary commands on galera cluster nodes. This threatens the system's confidentiality, integrity, and availability. This flaw affects mariadb versions before 10.1.47, before 10.2.34, before 10.3.25, before 10.4.15 and before 10.5.6.

A flaw was found in the mysql-wsrep component of mariadb. Lack of input sanitization in wsrep_sst_method allows for command injection that can be exploited by a remote attacker to execute arbitrary commands on galera cluster nodes. This threatens the system's confidentiality, integrity, and availability. This flaw affects mariadb versions before 10.1.47, before 10.2.34, before 10.3.25, before 10.4.15 and before 10.5.6.

This update fixes CVE-2020-15180

This update for mariadb-connector-c fixes the following issues:

• Update mariadb to 10.2.36 GA [bsc#1177472, bsc#1178428] fixing for the following security vulnerabilities: CVE-2020-14812, CVE-2020-14765, CVE-2020-14776, CVE-2020-14789 CVE-2020-15180

• Update mariadb-connector-c to 3.1.11 [bsc#1177472 and bsc#1178428]

This update was imported from the SUSE:SLE-15:Update update project.

This update for mariadb and mariadb-connector-c fixes the following issues:

• Update mariadb to 10.2.36 GA [bsc#1177472, bsc#1178428] fixing for the following security vulnerabilities: CVE-2020-14812, CVE-2020-14765, CVE-2020-14776, CVE-2020-14789 CVE-2020-15180

• Update mariadb-connector-c to 3.1.11 [bsc#1177472 and bsc#1178428]

This update was imported from the SUSE:SLE-15:Update update project.

This update for mariadb fixes the following issues:

Update to 10.4.17 [bsc#1177472] and [bsc#1178428]

• fixing for the following security vulnerabilities: CVE-2020-14812, CVE-2020-14765, CVE-2020-14776, CVE-2020-14789, CVE-2020-15180

This update was imported from the SUSE:SLE-15-SP2:Update update project.

These are all security issues fixed in the libmariadbd-devel-10.6.4-2.1 package on the GA media of openSUSE Tumbleweed.

This update for mariadb104 fixes the following issues:

• Implement version 10.4 of MariaDB (jsc#PED-2455):
  • It is possible to use more than one authentication plugin for each user account.
  • The root user account is being created with the ability to use two authentication plugins.
  • All user accounts, passwords, and global privileges are now stored in the mysql.global_priv table.
  • Is being supported for User Password Expiry, which is not active by default.
  • Faster privilege checks for MariaDB setups with many user accounts or many database grants.
• Update mysql-systemd-helper to be aware of custom group (bsc#1200105)
• MariaDB is now support lz4 compression for 'INNODB'. (bsc#1186031)
• Add 'mysql-user.conf' file to enable systemd generating mysql user in containers. (bsc#1173028)
• Fixes an issue when MariaDB is ignoring the value of the parameter 'open_files_limit' in the global variables. (bsc#1180014)

This update for mariadb104 fixes the following issues:

• Implement version 10.4 of MariaDB (jsc#PED-2455):
  • It is possible to use more than one authentication plugin for each user account.
  • The root user account is being created with the ability to use two authentication plugins.
  • All user accounts, passwords, and global privileges are now stored in the mysql.global_priv table.
  • Is being supported for User Password Expiry, which is not active by default.
  • Faster privilege checks for MariaDB setups with many user accounts or many database grants.
• Update mysql-systemd-helper to be aware of custom group (bsc#1200105)
• MariaDB is now support lz4 compression for 'INNODB'. (bsc#1186031)
• Add 'mysql-user.conf' file to enable systemd generating mysql user in containers. (bsc#1173028)
• Fixes an issue when MariaDB is ignoring the value of the parameter 'open_files_limit' in the global variables. (bsc#1180014)

This update for mariadb and mariadb-connector-c fixes the following issues:

• Update mariadb to 10.2.36 GA [bsc#1177472, bsc#1178428] fixing for the following security vulnerabilities: CVE-2020-14812, CVE-2020-14765, CVE-2020-14776, CVE-2020-14789 CVE-2020-15180

• Update mariadb-connector-c to 3.1.11 [bsc#1177472 and bsc#1178428]

This update for mariadb and mariadb-connector-c fixes the following issues:

• Update mariadb to 10.2.36 GA [bsc#1177472, bsc#1178428] fixing for the following security vulnerabilities: CVE-2020-14812, CVE-2020-14765, CVE-2020-14776, CVE-2020-14789 CVE-2020-15180

• Update mariadb-connector-c to 3.1.11 [bsc#1177472 and bsc#1178428]

This update for mariadb fixes the following issues:

Update to 10.4.17 [bsc#1177472] and [bsc#1178428]

• fixing for the following security vulnerabilities: CVE-2020-14812, CVE-2020-14765, CVE-2020-14776, CVE-2020-14789, CVE-2020-15180

This update for mariadb includes the following fixes:

Security fixes included in this update:

• CVE-2020-2752: Fixed an issue which could have resulted in unauthorized ability to cause denial of service.
• CVE-2020-2812: Fixed an issue which could have resulted in unauthorized ability to cause denial of service.
• CVE-2020-2814: Fixed an issue which could have resulted in unauthorized ability to cause denial of service.
• CVE-2020-2760: Fixed an issue which could have resulted in unauthorized ability to cause denial of service.
• CVE-2020-13249: Fixed an improper validation of the content of an OK packet received from a server.
• CVE-2020-14812: Fixed an issue which could have resulted in unauthorized ability to cause denial of service.
• CVE-2020-14765: Fixed an issue which could have resulted in unauthorized ability to cause denial of service.
• CVE-2020-14776: Fixed an issue which could have resulted in unauthorized ability of accessing data.
• CVE-2020-14789: Fixed an issue which could have resulted in unauthorized ability to cause denial of service.
• CVE-2020-15180: Fixed an issue in Galera which could have led to remote code execution.

Non Security fixes included in this update:

• Update to 10.2.36 GA [bsc#1177472] and [bsc#1178428]

  • release notes and changelog: https://mariadb.com/kb/en/library/mariadb-10236-release-notes https://mariadb.com/kb/en/library/mariadb-10236-changelog https://mariadb.com/kb/en/library/mariadb-10235-release-notes https://mariadb.com/kb/en/library/mariadb-10235-changelog https://mariadb.com/kb/en/library/mariadb-10234-release-notes https://mariadb.com/kb/en/library/mariadb-10234-changelog
  • fixes for the following security vulnerabilities: 10.2.36: none 10.2.35: CVE-2020-14812, CVE-2020-14765, CVE-2020-14776, CVE-2020-14789 10.2.34: CVE-2020-15180

• update suse_skipped_tests.list

• Update to 10.2.33 GA [bsc#1175596]

  • release notes and changelog: https://mariadb.com/kb/en/library/mariadb-10233-release-notes https://mariadb.com/kb/en/library/mariadb-10233-changelog
  • fixes for the following security vulnerabilities: none

• refresh mariadb-10.2.4-fortify-and-O.patch

• tune the testsuite to avoid randomly failing tests

• update suse_skipped_tests.list

• Update to 10.2.32 GA [bsc#1171550]

  • Fixes for the following security vulnerabilities: CVE-2020-2752, CVE-2020-2812, CVE-2020-2814, CVE-2020-2760, CVE-2020-13249
  • release notes and changelog: https://mariadb.com/kb/en/library/mariadb-10232-release-notes https://mariadb.com/kb/en/library/mariadb-10232-changelog

• refresh mariadb-10.2.4-fortify-and-O.patch

• drop specfile 'hacks' as things work correctly in upstream now:

  • renaming tmpfiles.conf -> mariadb.conf
  • installing pam_user_map.so to /lib64/security for non 32bit architectures
  • sysusers.conf was renamed to mariadb.conf

• update suse_skipped_tests.list

It was discovered that MariaDB didn't properly validate the content of a packet received from a server. A remote attacker could use this vulnerability to sent a specialy crafted file to cause a denial of service. (CVE-2020-13249)

It was discovered that MariaDB has other security issues. An attacker can cause a hang or frequently repeatable crash (denial of service). (CVE-2020-15180, CVE-2020-2752, CVE-2020-2760, CVE-2020-2812, CVE-2020-2814)

In addition to security fixes, the updated packages contain bug fixes, new features, and possibly incompatible changes.