{"id":"CVE-2017-10789","aliases":["DEBIAN-CVE-2017-10789","DLA-1079-1","EUVD-2017-2434","GHSA-4384-9v4p-2vmf","MGASA-2018-0031","MGASA-2018-0283","SUSE-SU-2018:1449-1","SUSE-SU-2018:1450-1","UBUNTU-CVE-2017-10789","USN-5344-1","USN-7417-1","openSUSE-SU-2024:11160-1"],"status":"published","title":"The DBD::mysql module through 4.043 for Perl uses the mysql_ssl=1 setting to mean that SSL is...","description":"The DBD::mysql module through 4.043 for Perl uses the mysql_ssl=1 setting to mean that SSL is optional (even though this setting's documentation has a \"your communication with the server will be encrypted\" statement), which allows man-in-the-middle attackers to spoof servers via a cleartext-downgrade attack, a related issue to CVE-2015-3152.","severity":{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02202,"percentile":0.82658,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2017-07-01T18:00:00Z","modified":"2026-10-20T10:48:56Z","fixes":[{"ecosystem":"Debian:12","package":"libdbd-mysql-perl","fixed_in":["4.046-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libdbd-mysql-perl","fixed_in":["4.046-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libdbd-mysql-perl","fixed_in":["4.046-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libdbd-mysql-perl","fixed_in":["4.025-1ubuntu0.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libdbd-mysql-perl","fixed_in":["4.033-1ubuntu0.1+esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"libdbd-mysql-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.046-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libdbd-mysql-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.046-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libdbd-mysql-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.046-1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"libdbd-mysql-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.021-1+deb7u3"}]}],"versions":["4.021-1","4.021-1+deb7u1","4.021-1+deb7u2"],"bundled":2},{"source":"osv","ecosystem":"Mageia:5","package":"perl-DBD-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.43.0-1.mga5"}]}],"bundled":5},{"source":"osv","ecosystem":"Mageia:6","package":"perl-DBD-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.43.0-1.mga6"}]}],"bundled":5},{"source":"osv","ecosystem":"Mageia:5","package":"perl-DBD-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.46.0-1.mga5"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:6","package":"perl-DBD-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.46.0-1.mga6"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"perl-DBD-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.008-10.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"perl-DBD-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.008-10.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"perl-DBD-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.008-10.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"perl-DBD-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.021-12.5.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"perl-DBD-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.021-12.5.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libdbd-mysql-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.025-1ubuntu0.1+esm1"}]}],"versions":["4.023-1","4.024-1","4.025-1","4.025-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libdbd-mysql-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.033-1ubuntu0.1+esm1"}]}],"versions":["4.028-2","4.033-1","4.033-1build1","4.033-1build2","4.033-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libdbd-mysql-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.033-1ubuntu0.1+esm1"}]}],"versions":["4.028-2","4.033-1","4.033-1build1","4.033-1build2","4.033-1ubuntu0.1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libdbd-mysql-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.025-1ubuntu0.1+esm1"}]}],"versions":["4.023-1","4.024-1","4.025-1","4.025-1ubuntu0.1"],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"perl-DBD-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.050-2.14"}]}],"bundled":2}],"products":[{"vendor":"dbd-mysql_project","product":"dbd-mysql"}],"references":[{"url":"http://www.securityfocus.com/bid/99364","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://github.com/perl5-dbi/DBD-mysql/issues/140","tags":["x_refsource_MISC","x_transferred","report"]},{"url":"https://github.com/perl5-dbi/DBD-mysql/pull/114","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://github.com/perl5-dbi/DBD-mysql/issues/110","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-10789"},{"url":"https://github.com/advisories/GHSA-4384-9v4p-2vmf"},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-10789","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2018-0031.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=19522","tags":["report"]},{"url":"https://www.debian.org/security/2016/dsa-3684","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/NY3AHSF4ZPQQ5OGYZYNQOD7TBL7CAG4F/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/7BLHU5FAHMKZBZ4LAHIASWUJVK4O6JS6/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/3CWISRFDOB7YRPBNDD3BNIQHSRYBDD6S/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/TAWTNCSYWNBJHJR4AYQAAW65JVWDWMEW/","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2018-0283.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=23154","tags":["report"]},{"url":"https://lists.opensuse.org/opensuse-updates/2018-05/msg00138.html","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20181449-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1047059","tags":["report"]},{"url":"https://bugzilla.suse.com/1047095","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-10788","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-10789","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20181450-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2017-10789","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5344-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-10789","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7417-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2016-1249","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-1251","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-10788","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2017-10789","description":"The DBD::mysql module through 4.043 for Perl uses the mysql_ssl=1 setting to mean that SSL is optional (even though this setting's documentation has a \"your communication with the server will be encrypted\" statement), which allows man-in-the-middle attackers to spoof servers via a cleartext-downgrade attack, a related issue to CVE-2015-3152.","status":"published","published":"2017-07-01T18:00:00Z","modified":"2024-08-05T17:50:12.094Z","updated_at":"2026-11-02T14:33:13.27226Z"}],"euvd":[{"id":"EUVD-2017-2434","description":"The DBD::mysql module through 4.043 for Perl uses the mysql_ssl=1 setting to mean that SSL is optional (even though this setting's documentation has a \"your communication with the server will be encrypted\" statement), which allows man-in-the-middle attackers to spoof servers via a cleartext-downgrade attack, a related issue to CVE-2015-3152.","status":"published","published":"2017-07-01T18:00:00Z","modified":"2024-08-05T17:50:12Z","updated_at":"2026-11-03T02:23:25.703104Z"}],"ghsa":[{"id":"GHSA-4384-9v4p-2vmf","title":"The DBD::mysql module through 4.043 for Perl uses the mysql_ssl=1 setting to mean that SSL is...","description":"The DBD::mysql module through 4.043 for Perl uses the mysql_ssl=1 setting to mean that SSL is optional (even though this setting's documentation has a \"your communication with the server will be encrypted\" statement), which allows man-in-the-middle attackers to spoof servers via a cleartext-downgrade attack, a related issue to CVE-2015-3152.","status":"published","published":"2022-05-13T01:41:58Z","modified":"2023-02-02T05:00:44Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T14:51:01.770569Z"}],"nvd":[{"id":"CVE-2017-10789","description":"The DBD::mysql module through 4.043 for Perl uses the mysql_ssl=1 setting to mean that SSL is optional (even though this setting's documentation has a \"your communication with the server will be encrypted\" statement), which allows man-in-the-middle attackers to spoof servers via a cleartext-downgrade attack, a related issue to CVE-2015-3152.","status":"published","published":"2017-07-01T18:29:00.237Z","modified":"2026-06-17T01:00:42.59Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:03:51.893212Z"}],"osv":[{"id":"CVE-2017-10789","description":"The DBD::mysql module through 4.043 for Perl uses the mysql_ssl=1 setting to mean that SSL is optional (even though this setting's documentation has a \"your communication with the server will be encrypted\" statement), which allows man-in-the-middle attackers to spoof servers via a cleartext-downgrade attack, a related issue to CVE-2015-3152.","status":"published","published":"2017-07-01T18:29:00.237Z","modified":"2026-10-20T10:48:56.594164536Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:03.851821Z"},{"id":"DEBIAN-CVE-2017-10789","description":"The DBD::mysql module through 4.043 for Perl uses the mysql_ssl=1 setting to mean that SSL is optional (even though this setting's documentation has a \"your communication with the server will be encrypted\" statement), which allows man-in-the-middle attackers to spoof servers via a cleartext-downgrade attack, a related issue to CVE-2015-3152.","status":"published","published":"2017-07-01T18:29:00.237Z","modified":"2026-09-01T20:03:40.891379952Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:28.207321Z"},{"id":"UBUNTU-CVE-2017-10789","description":"The DBD::mysql module through 4.043 for Perl uses the mysql_ssl=1 setting to mean that SSL is optional (even though this setting's documentation has a \"your communication with the server will be encrypted\" statement), which allows man-in-the-middle attackers to spoof servers via a cleartext-downgrade attack, a related issue to CVE-2015-3152.","status":"published","published":"2017-07-01T18:29:00Z","modified":"2026-02-04T02:51:48.025005Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:13.729565Z"},{"id":"DLA-1079-1","title":"libdbd-mysql-perl - security update","status":"published","published":"2017-08-30T00:00:00Z","modified":"2026-03-09T01:00:51.198561Z","updated_at":"2026-11-02T15:46:09.336894Z"},{"id":"MGASA-2018-0031","title":"Updated perl-DBD-mysql packages fix security vulnerability","description":"Pali Rohar discovered that DBD::mysql constructed an error message in a\nfixed-length buffer, leading to a crash (_FORTIFY_SOURCE failure) and,\npotentially, to denial of service (CVE-2016-1246).\n\nA vulnerability was discovered in perl-DBD-MySQL that can lead to an\nout-of-bounds read when using server side prepared statements with an\nunaligned number of placeholders in WHERE condition and output fields in\nSELECT expression (CVE-2016-1249).\n\nThere is a vulnerability of type use-after-free affecting DBD::mysql\nbefore 4.041 when used with mysql_server_prepare=1 (CVE-2016-1251).\n\nThe DBD::mysql module through 4.043 for Perl allows remote attackers to\ncause a denial of service (use-after-free and application crash) or\npossibly have unspecified other impact by triggering (1) certain error\nresponses from a MySQL server or (2) a loss of a network connection to a\nMySQL server. The use-after-free defect was introduced by relying on\nincorrect Oracle mysql_stmt_close documentation and code examples\n(CVE-2017-10788).\n\nThe DBD::mysql module through 4.043 for Perl uses the mysql_ssl=1 setting\nto mean that SSL is optional (even though this setting's documentation has\na \"your communication with the server will be encrypted\" statement), which\nallows man-in-the-middle attackers to spoof servers via a\ncleartext-downgrade attack (CVE-2017-10789).\n\nNote that the CVE-2016-1246, CVE-2017-1249, and CVE-2016-1251 issues only\naffected Mageia 5.\n\nAlso note that server-side prepared statements are disabled by default.\n","status":"published","published":"2018-01-03T14:22:14Z","modified":"2026-04-16T06:23:12.758730025Z","updated_at":"2026-11-02T15:49:40.442238Z"},{"id":"MGASA-2018-0283","title":"Updated perl-DBD-mysql packages fix security vulnerabilities","description":"Updated perl-DBD-mysql package fixes security vulnerabilities:\n\nThe DBD::mysql Perl module through 4.043 for Perl allows remote attackers to\ncause a denial of service (use-after-free and application crash) or possibly\nhave unspecified other impact by triggering certain error responses from a\nMySQL server or a loss of a network connection to a MySQL server. The\nuse-after-free defect was introduced by relying on incorrect Oracle\nmysql_stmt_close documentation and code examples (CVE-2017-10788).\n\nThe DBD::mysql Perl module, when used with mysql_ssl=1 setting enabled, means\nthat SSL is optional (even though this setting's documentation has a \"your communication with the server will be encrypted\" statement), which could lead\nman-in-the-middle attackers to spoof servers via a cleartext-downgrade attack\n(CVE-2017-10789).\n","status":"published","published":"2018-06-14T18:14:36Z","modified":"2026-04-16T06:23:31.62822093Z","updated_at":"2026-11-02T15:49:40.442238Z"},{"id":"openSUSE-SU-2024:11160-1","title":"perl-DBD-mysql-4.050-2.14 on GA media","description":"These are all security issues fixed in the perl-DBD-mysql-4.050-2.14 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:13:31.443467Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-SU-2018:1449-1","title":"Security update for perl-DBD-mysql","description":"This update for perl-DBD-mysql fixes the following issues:\n\n- CVE-2017-10789: The DBD::mysql module when with mysql_ssl=1 setting enabled, means that SSL is optional \n(even though this setting's documentation has a \\'your communication with the server will be encrypted\\' statement), \nwhich could lead man-in-the-middle attackers to spoof servers via a cleartext-downgrade attack, \na related issue to CVE-2015-3152. (bsc#1047059)\n- CVE-2017-10788: The DBD::mysql module through 4.043 for Perl allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly have unspecified other impact by triggering (1) certain error responses from a MySQL server or (2) a loss of a network connection to a MySQL server. The use-after-free defect was introduced by relying on incorrect Oracle mysql_stmt_close documentation and code examples. (bsc#1047095)\n\n","status":"published","published":"2018-05-28T11:50:09Z","modified":"2026-02-04T02:17:37.314044Z","updated_at":"2026-11-02T15:53:44.972817Z"},{"id":"SUSE-SU-2018:1450-1","title":"Security update for perl-DBD-mysql","description":"This update for perl-DBD-mysql fixes the following issues:\n\n- CVE-2017-10789: The DBD::mysql module when with mysql_ssl=1 setting enabled, means that SSL is optional (even though this setting's documentation has a \\'your communication with the server will be encrypted\\' statement), which could lead man-in-the-middle attackers to spoof servers via a cleartext-downgrade attack, a related issue to CVE-2015-3152. (bsc#1047059)\n- CVE-2017-10788: The DBD::mysql module through 4.043 for Perl allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly have unspecified other impact by triggering (1) certain error responses from a MySQL server or (2) a loss of a network connection to a MySQL server. The use-after-free defect was introduced by relying on incorrect Oracle mysql_stmt_close documentation and code examples. (bsc#1047095)\n\n","status":"published","published":"2018-05-28T11:48:49Z","modified":"2026-02-04T03:33:34.998447Z","updated_at":"2026-11-02T15:53:44.972817Z"},{"id":"USN-5344-1","title":"libdbd-mysql-perl vulnerabilities","description":"It was discovered that the DBD::mysql module, when configured with server-side\nprepared statement support, was susceptible to operations that would result in\nimproper memory access. An attacker could possibly use this issue to cause\nDBD::mysql to crash, resulting in a denial of service.\n(CVE-2016-1249, CVE-2016-1251)\n\nIt was discovered that the DBD::mysql module was susceptible to an operation\nthat would result in improper memory access, introduced through incorrect\ndocumentation and code examples. An attacker could possibly use this issue to\ncause DBD::mysql to crash or potentially cause other, unspecified, impact.\n(CVE-2017-10788)\n\nIt was discovered that the DBD::mysql module processed SSL/TLS settings in a\nway that did not fully correlate with the respective documentation for each\nsetting. An attacker could possibly use this to perform a cleartext-downgrade\nattack. (CVE-2017-10789)\n","status":"published","published":"2022-04-01T20:31:18Z","modified":"2026-06-25T13:31:06.029171942Z","updated_at":"2026-11-02T16:58:15.683829Z"},{"id":"USN-7417-1","title":"libdbd-mysql-perl vulnerabilities","description":"It was discovered that libdbd-mysql-perl did not correctly handle certain\nSQL queries. An attacker could possibly use this issue to cause a denial\nof service. (CVE-2016-1249)\n\nIt was discovered that libdbd-mysql-perl did not correctly handle certain\nmemory operations, which could lead to a use-after-free vulnerability. A\nremote attacker could possibly use this issue to cause a denial of service\nor execute arbitrary code. (CVE-2016-1251, CVE-2017-10788)\n\nIt was discovered that libdbd-mysql-perl did not properly enforce SSL\nconnections depending on the mysql_ssl setting. A machine-in-the-middle\nattacker could possibly use this issue to spoof servers. (CVE-2017-10789)\n","status":"published","published":"2025-04-07T01:37:37Z","modified":"2026-02-10T04:47:48Z","updated_at":"2026-11-02T16:58:19.988474Z"}]}}