CVE-2020-2752

Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are affected are 5.6.47 and prior, 5.7.27 and prior and 8.0.17 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Client. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Client. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H).

The MySQL(TM) software delivers a very fast, multi-threaded, multi-user, and robust SQL (Structured Query Language) database server. MySQL Server is intended for mission-critical, heavy-load production systems as well as for embedding into mass-deployed software. MySQL is a trademark of Oracle and/or its affiliates The MySQL software has Dual Licensing, which means you can use the MySQL software free of charge under the GNU General Public License (http://www.gnu.org/licenses/). You can also purchase commercial MySQL licenses from Oracle and/or its affiliates if you do not wish to be bound by the terms of the GPL.

Security Fix(es):

Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are affected are 5.6.47 and prior, 5.7.27 and prior and 8.0.17 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Client. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Client. (CVE-2020-2752)

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.017 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data.(CVE-2019-2991)

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.17 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.(CVE-2019-2966)

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.17 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.(CVE-2019-2963)

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.17 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.(CVE-2019-2998)

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser). Supported versions that are affected are 8.0.17 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.(CVE-2019-3004)

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Encryption). Supported versions that are affected are 8.0.17 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.(CVE-2019-2957)

Vulnerability in the MySQL Server product…

MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon (mysqld) and many client programs and libraries.

The following packages have been upgraded to a later upstream version: mysql (8.0.21).

Security Fix(es):

• mysql: Server: Security: Privileges multiple unspecified vulnerabilities (CVE-2020-14663, CVE-2020-14678, CVE-2020-14697, CVE-2020-2761, CVE-2020-2774, CVE-2020-2779, CVE-2020-2853, CVE-2020-14586, CVE-2020-14702)

• mysql: Server: Security: Encryption multiple unspecified vulnerabilities (CVE-2019-2914, CVE-2019-2957)

• mysql: InnoDB multiple unspecified vulnerabilities (CVE-2019-2938, CVE-2019-2963, CVE-2019-2968, CVE-2019-3018, CVE-2020-2577, CVE-2020-2589, CVE-2020-2760, CVE-2020-2762, CVE-2020-2814, CVE-2020-2893, CVE-2020-2895, CVE-2020-14568, CVE-2020-14623, CVE-2020-14633, CVE-2020-14634)

• mysql: Server: PS multiple unspecified vulnerabilities (CVE-2019-2946, CVE-2020-2925)

• mysql: Server: Replication multiple unspecified vulnerabilities (CVE-2019-2960, CVE-2020-2759, CVE-2020-2763, CVE-2020-14567)

• mysql: Server: Optimizer multiple unspecified vulnerabilities (CVE-2019-2966, CVE-2019-2967, CVE-2019-2974, CVE-2019-2982, CVE-2019-2991, CVE-2019-2998, CVE-2020-2579, CVE-2020-2660, CVE-2020-2679, CVE-2020-2686, CVE-2020-2765, CVE-2020-2892, CVE-2020-2897, CVE-2020-2901, CVE-2020-2904, CVE-2020-2923, CVE-2020-2924, CVE-2020-2928, CVE-2020-14539, CVE-2020-14547, CVE-2020-14597, CVE-2020-14614, CVE-2020-14654, CVE-2020-14680, CVE-2020-14725)

• mysql: Server: C API multiple unspecified vulnerabilities (CVE-2019-2993, CVE-2019-3011)

• mysql: Server: DDL multiple unspecified vulnerabilities (CVE-2019-2997, CVE-2020-2580)

• mysql: Server: Parser multiple unspecified vulnerabilities (CVE-2019-3004, CVE-2020-2627, CVE-2020-2930, CVE-2020-14619)

• mysql: Server: Connection unspecified vulnerability (CVE-2019-3009)

• mysql: Server: Options multiple unspecified vulnerabilities (CVE-2020-2584, CVE-2020-14632)

• mysql: Server: DML multiple unspecified vulnerabilities (CVE-2020-2588, CVE-2020-2780, CVE-2020-14540, CVE-2020-14575, CVE-2020-14620)

• mysql: C API multiple unspecified vulnerabilities (CVE-2020-2752, CVE-2020-2922, CVE-2020-14550, CVE-2020-2570, CVE-2020-2573, CVE-2020-2574)

• mysql: Server: Logging unspecified vulnerability (CVE-2020-2770)

• mysql: Server: Memcached unspecified vulnerability (CVE-2020-2804)

• mysql: Server: Stored Procedure unspecified vulnerability (CVE-2020-2812)

• mysql: Server: Information Schema multiple unspecified vulnerabilities (CVE-2020-2896, CVE-2020-14559, CVE-2020-2694)

• mysql: Server: Charsets unspecified vulnerability (CVE-2020-2898)

• mysql: Server: Connection Handling unspecified vulnerability (CVE-2020-2903)

• mysql: Server: Group Replication Plugin unspecified vulnerability (CVE-2020-2921)

• mysql: Server: Group Replication GCS unspecified vulnerability (CVE-2020-2926)

• mysql: Server: Pluggable Auth unspecified vulnerability (CVE-2020-14553)

• mysql: Server: UDF unspecified vulnerability (CVE-2020-14576)

• mysql: Server: JSON unspecified vulnerability (CVE-2020-14624)

• mysql: Server: Security: Audit unspecified vulnerability (CVE-2020-14631)

• mysql: Server: Security: Roles multiple unspecified vulnerabilities (CVE-2020-14641, CVE-2020-14643, CVE-2020-14651)

• mysql: Server: Locking unspecified vulnerability (CVE-2020-14656)

• mysql: Information Schema unspecified vulnerability (CVE-2019-2911)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL.

The following packages have been upgraded to a later upstream version: mariadb (10.3.27), galera (25.3.31). (BZ#1899082, BZ#1899086)

Security Fix(es):

• mariadb: Insufficient SST method name check leading to code injection in mysql-wsrep (CVE-2020-15180)

• mysql: InnoDB unspecified vulnerability (CPU Oct 2019) (CVE-2019-2938)

• mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2019) (CVE-2019-2974)

• mysql: C API unspecified vulnerability (CPU Apr 2020) (CVE-2020-2752)

• mysql: InnoDB unspecified vulnerability (CPU Apr 2020) (CVE-2020-2760)

• mysql: Server: DML unspecified vulnerability (CPU Apr 2020) (CVE-2020-2780)

• mysql: Server: Stored Procedure unspecified vulnerability (CPU Apr 2020) (CVE-2020-2812)

• mysql: InnoDB unspecified vulnerability (CPU Apr 2020) (CVE-2020-2814)

• mariadb-connector-c: Improper validation of content in a OK packet received from server (CVE-2020-13249)

• mysql: Server: FTS unspecified vulnerability (CPU Oct 2020) (CVE-2020-14765)

• mysql: InnoDB unspecified vulnerability (CPU Oct 2020) (CVE-2020-14776)

• mysql: Server: FTS unspecified vulnerability (CPU Oct 2020) (CVE-2020-14789)

• mysql: Server: Locking unspecified vulnerability (CPU Oct 2020) (CVE-2020-14812)

• mysql: C API unspecified vulnerability (CPU Jan 2020) (CVE-2020-2574)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• FTBFS: -D_GLIBCXX_ASSERTIONS (BZ#1899009)

• Queries with entity_id IN ('1', '2', …, '70000') run much slower in MariaDB 10.3 than on MariaDB 10.1 (BZ#1899017)

• Cleanup race with wsrep_rsync_sst_tunnel may prevent full galera cluster bootstrap (BZ#1899021)

• There are undeclared file conflicts in several mariadb and mysql packages (BZ#1899077)

The MariaDB Native Client library (C driver) is used to connect applications developed in C/C++ to MariaDB and MySQL databases.

The following packages have been upgraded to a later upstream version: mariadb-connector-c (3.1.11). (BZ#1898993)

Security Fix(es):

• mysql: C API unspecified vulnerability (CPU Apr 2020) (CVE-2020-2752)

• mysql: C API unspecified vulnerability (CPU Apr 2020) (CVE-2020-2922)

• mariadb-connector-c: Improper validation of content in a OK packet received from server (CVE-2020-13249)

• mysql: C API unspecified vulnerability (CPU Jan 2020) (CVE-2020-2574)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• Code utilizing plugins can't be compiled properly (BZ#1899001)

• Add "zlib-devel" requirement in "-devel" subpackage (BZ#1899005)

• Replace hard-coded /usr with %{_prefix} (BZ#1899099)

Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are affected are 5.6.47 and prior, 5.7.27 and prior and 8.0.17 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Client. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Client. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H).

MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon (mysqld) and many client programs and libraries.

The following packages have been upgraded to a later upstream version: mysql (8.0.21).

Security Fix(es):

• mysql: Server: Security: Privileges multiple unspecified vulnerabilities (CVE-2020-14663, CVE-2020-14678, CVE-2020-14697, CVE-2020-2761, CVE-2020-2774, CVE-2020-2779, CVE-2020-2853, CVE-2020-14586, CVE-2020-14702)

• mysql: Server: Security: Encryption multiple unspecified vulnerabilities (CVE-2019-2914, CVE-2019-2957)

• mysql: InnoDB multiple unspecified vulnerabilities (CVE-2019-2938, CVE-2019-2963, CVE-2019-2968, CVE-2019-3018, CVE-2020-2577, CVE-2020-2589, CVE-2020-2760, CVE-2020-2762, CVE-2020-2814, CVE-2020-2893, CVE-2020-2895, CVE-2020-14568, CVE-2020-14623, CVE-2020-14633, CVE-2020-14634)

• mysql: Server: PS multiple unspecified vulnerabilities (CVE-2019-2946, CVE-2020-2925)

• mysql: Server: Replication multiple unspecified vulnerabilities (CVE-2019-2960, CVE-2020-2759, CVE-2020-2763, CVE-2020-14567)

• mysql: Server: Optimizer multiple unspecified vulnerabilities (CVE-2019-2966, CVE-2019-2967, CVE-2019-2974, CVE-2019-2982, CVE-2019-2991, CVE-2019-2998, CVE-2020-2579, CVE-2020-2660, CVE-2020-2679, CVE-2020-2686, CVE-2020-2765, CVE-2020-2892, CVE-2020-2897, CVE-2020-2901, CVE-2020-2904, CVE-2020-2923, CVE-2020-2924, CVE-2020-2928, CVE-2020-14539, CVE-2020-14547, CVE-2020-14597, CVE-2020-14614, CVE-2020-14654, CVE-2020-14680, CVE-2020-14725)

• mysql: Server: C API multiple unspecified vulnerabilities (CVE-2019-2993, CVE-2019-3011)

• mysql: Server: DDL multiple unspecified vulnerabilities (CVE-2019-2997, CVE-2020-2580)

• mysql: Server: Parser multiple unspecified vulnerabilities (CVE-2019-3004, CVE-2020-2627, CVE-2020-2930, CVE-2020-14619)

• mysql: Server: Connection unspecified vulnerability (CVE-2019-3009)

• mysql: Server: Options multiple unspecified vulnerabilities (CVE-2020-2584, CVE-2020-14632)

• mysql: Server: DML multiple unspecified vulnerabilities (CVE-2020-2588, CVE-2020-2780, CVE-2020-14540, CVE-2020-14575, CVE-2020-14620)

• mysql: C API multiple unspecified vulnerabilities (CVE-2020-2752, CVE-2020-2922, CVE-2020-14550, CVE-2020-2570, CVE-2020-2573, CVE-2020-2574)

• mysql: Server: Logging unspecified vulnerability (CVE-2020-2770)

• mysql: Server: Memcached unspecified vulnerability (CVE-2020-2804)

• mysql: Server: Stored Procedure unspecified vulnerability (CVE-2020-2812)

• mysql: Server: Information Schema multiple unspecified vulnerabilities (CVE-2020-2896, CVE-2020-14559, CVE-2020-2694)

• mysql: Server: Charsets unspecified vulnerability (CVE-2020-2898)

• mysql: Server: Connection Handling unspecified vulnerability (CVE-2020-2903)

• mysql: Server: Group Replication Plugin unspecified vulnerability (CVE-2020-2921)

• mysql: Server: Group Replication GCS unspecified vulnerability (CVE-2020-2926)

• mysql: Server: Pluggable Auth unspecified vulnerability (CVE-2020-14553)

• mysql: Server: UDF unspecified vulnerability (CVE-2020-14576)

• mysql: Server: JSON unspecified vulnerability (CVE-2020-14624)

• mysql: Server: Security: Audit unspecified vulnerability (CVE-2020-14631)

• mysql: Server: Security: Roles multiple unspecified vulnerabilities (CVE-2020-14641, CVE-2020-14643, CVE-2020-14651)

• mysql: Server: Locking unspecified vulnerability (CVE-2020-14656)

• mysql: Information Schema unspecified vulnerability (CVE-2019-2911)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL.

The following packages have been upgraded to a later upstream version: mariadb (10.3.27), galera (25.3.31). (BZ#1899082, BZ#1899086)

Security Fix(es):

• mariadb: Insufficient SST method name check leading to code injection in mysql-wsrep (CVE-2020-15180)

• mysql: InnoDB unspecified vulnerability (CPU Oct 2019) (CVE-2019-2938)

• mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2019) (CVE-2019-2974)

• mysql: C API unspecified vulnerability (CPU Apr 2020) (CVE-2020-2752)

• mysql: InnoDB unspecified vulnerability (CPU Apr 2020) (CVE-2020-2760)

• mysql: Server: DML unspecified vulnerability (CPU Apr 2020) (CVE-2020-2780)

• mysql: Server: Stored Procedure unspecified vulnerability (CPU Apr 2020) (CVE-2020-2812)

• mysql: InnoDB unspecified vulnerability (CPU Apr 2020) (CVE-2020-2814)

• mariadb-connector-c: Improper validation of content in a OK packet received from server (CVE-2020-13249)

• mysql: Server: FTS unspecified vulnerability (CPU Oct 2020) (CVE-2020-14765)

• mysql: InnoDB unspecified vulnerability (CPU Oct 2020) (CVE-2020-14776)

• mysql: Server: FTS unspecified vulnerability (CPU Oct 2020) (CVE-2020-14789)

• mysql: Server: Locking unspecified vulnerability (CPU Oct 2020) (CVE-2020-14812)

• mysql: C API unspecified vulnerability (CPU Jan 2020) (CVE-2020-2574)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• FTBFS: -D_GLIBCXX_ASSERTIONS (BZ#1899009)

• Queries with entity_id IN ('1', '2', …, '70000') run much slower in MariaDB 10.3 than on MariaDB 10.1 (BZ#1899017)

• Cleanup race with wsrep_rsync_sst_tunnel may prevent full galera cluster bootstrap (BZ#1899021)

• There are undeclared file conflicts in several mariadb and mysql packages (BZ#1899077)

The MariaDB Native Client library (C driver) is used to connect applications developed in C/C++ to MariaDB and MySQL databases.

The following packages have been upgraded to a later upstream version: mariadb-connector-c (3.1.11). (BZ#1898993)

Security Fix(es):

• mysql: C API unspecified vulnerability (CPU Apr 2020) (CVE-2020-2752)

• mysql: C API unspecified vulnerability (CPU Apr 2020) (CVE-2020-2922)

• mariadb-connector-c: Improper validation of content in a OK packet received from server (CVE-2020-13249)

• mysql: C API unspecified vulnerability (CPU Jan 2020) (CVE-2020-2574)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• Code utilizing plugins can't be compiled properly (BZ#1899001)

• Add "zlib-devel" requirement in "-devel" subpackage (BZ#1899005)

• Replace hard-coded /usr with %{_prefix} (BZ#1899099)

Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are affected are 5.6.47 and prior, 5.7.27 and prior and 8.0.17 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Client. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Client. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H).

Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are affected are 5.6.47 and prior, 5.7.27 and prior and 8.0.17 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Client. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Client. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H).

Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are affected are 5.6.47 and prior, 5.7.27 and prior and 8.0.17 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Client. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Client. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H).

Updated mariadb packages fix security vulnerabilities:

Vulnerability in the MariaDB Client product of MariaDB (component: C API) Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MariaDB Client. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MariaDB Client (CVE-2020-2752).

Vulnerability in the MariaDB Server product of MariaDB (component: InnoDB). Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MariaDB Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MariaDB Server as well as unauthorized update, insert or delete access to some of MariaDB Server accessible data (CVE-2020-2760).

Vulnerability in the MariaDB Server product of MariaDB (component: Server: Stored Procedure). Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MariaDB Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MariaDB Server (CVE-2020-2812).

Vulnerability in the MariaDB Server product of MariaDB (component: InnoDB). Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MariaDB Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MariaDB Server (CVE-2020-2814).

This update for mariadb to version 10.2.32 fixes the following issues:

mariadb was updated to version 10.2.32 (bsc#1171550)

• CVE-2020-2752: Fixed an issue which could have resulted in unauthorized ability to cause denial of service.
• CVE-2020-2812: Fixed an issue which could have resulted in unauthorized ability to cause denial of service.
• CVE-2020-2814: Fixed an issue which could have resulted in unauthorized ability to cause denial of service.
• CVE-2020-2760: Fixed an issue which could have resulted in unauthorized ability to cause denial of service.
• CVE-2020-13249: Fixed an improper validation of the content of an OK packet received from a server.

Release notes and changelog:

• https://mariadb.com/kb/en/library/mariadb-10232-release-notes
• https://mariadb.com/kb/en/library/mariadb-10232-changelog

This update was imported from the SUSE:SLE-15:Update update project.

These are all security issues fixed in the libmariadbd-devel-10.6.4-2.1 package on the GA media of openSUSE Tumbleweed.

This update for mariadb104 fixes the following issues:

• Implement version 10.4 of MariaDB (jsc#PED-2455):
  • It is possible to use more than one authentication plugin for each user account.
  • The root user account is being created with the ability to use two authentication plugins.
  • All user accounts, passwords, and global privileges are now stored in the mysql.global_priv table.
  • Is being supported for User Password Expiry, which is not active by default.
  • Faster privilege checks for MariaDB setups with many user accounts or many database grants.
• Update mysql-systemd-helper to be aware of custom group (bsc#1200105)
• MariaDB is now support lz4 compression for 'INNODB'. (bsc#1186031)
• Add 'mysql-user.conf' file to enable systemd generating mysql user in containers. (bsc#1173028)
• Fixes an issue when MariaDB is ignoring the value of the parameter 'open_files_limit' in the global variables. (bsc#1180014)

This update for mariadb104 fixes the following issues:

• Implement version 10.4 of MariaDB (jsc#PED-2455):
  • It is possible to use more than one authentication plugin for each user account.
  • The root user account is being created with the ability to use two authentication plugins.
  • All user accounts, passwords, and global privileges are now stored in the mysql.global_priv table.
  • Is being supported for User Password Expiry, which is not active by default.
  • Faster privilege checks for MariaDB setups with many user accounts or many database grants.
• Update mysql-systemd-helper to be aware of custom group (bsc#1200105)
• MariaDB is now support lz4 compression for 'INNODB'. (bsc#1186031)
• Add 'mysql-user.conf' file to enable systemd generating mysql user in containers. (bsc#1173028)
• Fixes an issue when MariaDB is ignoring the value of the parameter 'open_files_limit' in the global variables. (bsc#1180014)

This update for mariadb fixes the following issues:

mariadb was updated to version 10.0.44 (bsc#1171550)

• CVE-2020-2752: Fixed an issue which could have resulted in unauthorized ability to cause denial of service.
• CVE-2020-2812: Fixed an issue which could have resulted in unauthorized ability to cause denial of service.

This update for mariadb fixes the following issues:

mariadb was updated to version 10.2.32 (bsc#1171550)

• CVE-2020-2752: Fixed an issue which could have resulted in unauthorized ability to cause denial of service.
• CVE-2020-2812: Fixed an issue which could have resulted in unauthorized ability to cause denial of service.
• CVE-2020-2814: Fixed an issue which could have resulted in unauthorized ability to cause denial of service.
• CVE-2020-2760: Fixed an issue which could have resulted in unauthorized ability to cause denial of service.
• CVE-2020-13249: Fixed an improper validation of the content of an OK packet received from a server.

Release notes and changelog:

• https://mariadb.com/kb/en/library/mariadb-10232-release-notes
• https://mariadb.com/kb/en/library/mariadb-10232-changelog
• Update to 10.2.32 GA [bsc#1171550]

This update for mariadb to version 10.2.32 fixes the following issues:

mariadb was updated to version 10.2.32 (bsc#1171550)

• CVE-2020-2752: Fixed an issue which could have resulted in unauthorized ability to cause denial of service.
• CVE-2020-2812: Fixed an issue which could have resulted in unauthorized ability to cause denial of service.
• CVE-2020-2814: Fixed an issue which could have resulted in unauthorized ability to cause denial of service.
• CVE-2020-2760: Fixed an issue which could have resulted in unauthorized ability to cause denial of service.
• CVE-2020-13249: Fixed an improper validation of the content of an OK packet received from a server.

Release notes and changelog:

• https://mariadb.com/kb/en/library/mariadb-10232-release-notes
• https://mariadb.com/kb/en/library/mariadb-10232-changelog

This update for mariadb-100 fixes the following issues:

mariadb-100 was updated to version 10.0.44 (bsc#1171550)

• CVE-2020-2752: Fixed an issue which could have resulted in unauthorized ability to cause denial of service.
• CVE-2020-2812: Fixed an issue which could have resulted in unauthorized ability to cause denial of service.
• Fixed some test failures

This update for mariadb includes the following fixes:

Security fixes included in this update:

• CVE-2020-2752: Fixed an issue which could have resulted in unauthorized ability to cause denial of service.
• CVE-2020-2812: Fixed an issue which could have resulted in unauthorized ability to cause denial of service.
• CVE-2020-2814: Fixed an issue which could have resulted in unauthorized ability to cause denial of service.
• CVE-2020-2760: Fixed an issue which could have resulted in unauthorized ability to cause denial of service.
• CVE-2020-13249: Fixed an improper validation of the content of an OK packet received from a server.
• CVE-2020-14812: Fixed an issue which could have resulted in unauthorized ability to cause denial of service.
• CVE-2020-14765: Fixed an issue which could have resulted in unauthorized ability to cause denial of service.
• CVE-2020-14776: Fixed an issue which could have resulted in unauthorized ability of accessing data.
• CVE-2020-14789: Fixed an issue which could have resulted in unauthorized ability to cause denial of service.
• CVE-2020-15180: Fixed an issue in Galera which could have led to remote code execution.

Non Security fixes included in this update:

• Update to 10.2.36 GA [bsc#1177472] and [bsc#1178428]

  • release notes and changelog: https://mariadb.com/kb/en/library/mariadb-10236-release-notes https://mariadb.com/kb/en/library/mariadb-10236-changelog https://mariadb.com/kb/en/library/mariadb-10235-release-notes https://mariadb.com/kb/en/library/mariadb-10235-changelog https://mariadb.com/kb/en/library/mariadb-10234-release-notes https://mariadb.com/kb/en/library/mariadb-10234-changelog
  • fixes for the following security vulnerabilities: 10.2.36: none 10.2.35: CVE-2020-14812, CVE-2020-14765, CVE-2020-14776, CVE-2020-14789 10.2.34: CVE-2020-15180

• update suse_skipped_tests.list

• Update to 10.2.33 GA [bsc#1175596]

  • release notes and changelog: https://mariadb.com/kb/en/library/mariadb-10233-release-notes https://mariadb.com/kb/en/library/mariadb-10233-changelog
  • fixes for the following security vulnerabilities: none

• refresh mariadb-10.2.4-fortify-and-O.patch

• tune the testsuite to avoid randomly failing tests

• update suse_skipped_tests.list

• Update to 10.2.32 GA [bsc#1171550]

  • Fixes for the following security vulnerabilities: CVE-2020-2752, CVE-2020-2812, CVE-2020-2814, CVE-2020-2760, CVE-2020-13249
  • release notes and changelog: https://mariadb.com/kb/en/library/mariadb-10232-release-notes https://mariadb.com/kb/en/library/mariadb-10232-changelog

• refresh mariadb-10.2.4-fortify-and-O.patch

• drop specfile 'hacks' as things work correctly in upstream now:

  • renaming tmpfiles.conf -> mariadb.conf
  • installing pam_user_map.so to /lib64/security for non 32bit architectures
  • sysusers.conf was renamed to mariadb.conf

• update suse_skipped_tests.list

It was discovered that MariaDB didn't properly validate the content of a packet received from a server. A remote attacker could use this vulnerability to sent a specialy crafted file to cause a denial of service. (CVE-2020-13249)

It was discovered that MariaDB has other security issues. An attacker can cause a hang or frequently repeatable crash (denial of service). (CVE-2020-15180, CVE-2020-2752, CVE-2020-2760, CVE-2020-2812, CVE-2020-2814)

In addition to security fixes, the updated packages contain bug fixes, new features, and possibly incompatible changes.