Vulnerabilities > CVE-2019-2938

047910
CVSS 4.4 - MEDIUM
Attack vector
NETWORK
Attack complexity
HIGH
Privileges required
HIGH
Confidentiality impact
NONE
Integrity impact
NONE
Availability impact
HIGH

Summary

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.27 and prior and 8.0.17 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).

Vulnerable Configurations

Part Description Count
Application
Oracle
45
Application
Mariadb
56
Application
Netapp
5
OS
Fedoraproject
3
OS
Canonical
4
OS
Opensuse
1

Nessus

  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2019-48A0A07033.NASL
    description**MySQL 8.0.18** Release notes : https://dev.mysql.com/doc/relnotes/mysql/8.0/en/news-8-0-18.html CVEs fixed : CVE-2019-2911 CVE-2019-2914 CVE-2019-2938 CVE-2019-2946 CVE-2019-2957 CVE-2019-2960 CVE-2019-2963 CVE-2019-2966 CVE-2019-2967 CVE-2019-2968 CVE-2019-2974 CVE-2019-2982 CVE-2019-2991 CVE-2019-2993 CVE-2019-2997 CVE-2019-2998 CVE-2019-3004 CVE-2019-3009 CVE-2019-3011 CVE-2019-3018 https://bugzilla.redhat.com/show_bug.cgi?id=1768175 https://www.oracle.com/security-alerts/cpuoct2019.html Maintainer notes : linking with GOLD disabled on armv7hl, because of https://bugs.mysql.com/bug.php?id=96698 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id130783
    published2019-11-12
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/130783
    titleFedora 30 : community-mysql (2019-48a0a07033)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Fedora Security Advisory FEDORA-2019-48a0a07033.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(130783);
      script_version("1.2");
      script_cvs_date("Date: 2019/12/12");
    
      script_cve_id("CVE-2019-2911", "CVE-2019-2914", "CVE-2019-2938", "CVE-2019-2946", "CVE-2019-2957", "CVE-2019-2960", "CVE-2019-2963", "CVE-2019-2966", "CVE-2019-2967", "CVE-2019-2968", "CVE-2019-2974", "CVE-2019-2982", "CVE-2019-2991", "CVE-2019-2993", "CVE-2019-2997", "CVE-2019-2998", "CVE-2019-3004", "CVE-2019-3009", "CVE-2019-3011", "CVE-2019-3018");
      script_xref(name:"FEDORA", value:"2019-48a0a07033");
    
      script_name(english:"Fedora 30 : community-mysql (2019-48a0a07033)");
      script_summary(english:"Checks rpm output for the updated package.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Fedora host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "**MySQL 8.0.18**
    
    Release notes :
    
    https://dev.mysql.com/doc/relnotes/mysql/8.0/en/news-8-0-18.html
    
    CVEs fixed :
    
    CVE-2019-2911 CVE-2019-2914 CVE-2019-2938 CVE-2019-2946 CVE-2019-2957
    CVE-2019-2960 CVE-2019-2963 CVE-2019-2966 CVE-2019-2967 CVE-2019-2968
    CVE-2019-2974 CVE-2019-2982 CVE-2019-2991 CVE-2019-2993 CVE-2019-2997
    CVE-2019-2998 CVE-2019-3004 CVE-2019-3009 CVE-2019-3011 CVE-2019-3018
    https://bugzilla.redhat.com/show_bug.cgi?id=1768175
    https://www.oracle.com/security-alerts/cpuoct2019.html
    
    Maintainer notes :
    
    linking with GOLD disabled on armv7hl, because of
    https://bugs.mysql.com/bug.php?id=96698
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the Fedora update system website.
    Tenable has attempted to automatically clean and format it as much as
    possible without introducing additional issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bodhi.fedoraproject.org/updates/FEDORA-2019-48a0a07033"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugs.mysql.com/bug.php?id=96698"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected community-mysql package."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:N/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-2991");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:community-mysql");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:30");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2019/10/16");
      script_set_attribute(attribute:"patch_publication_date", value:"2019/11/12");
      script_set_attribute(attribute:"plugin_publication_date", value:"2019/11/12");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Fedora Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora");
    os_ver = pregmatch(pattern: "Fedora.*release ([0-9]+)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora");
    os_ver = os_ver[1];
    if (! preg(pattern:"^30([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 30", "Fedora " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu);
    
    
    flag = 0;
    if (rpm_check(release:"FC30", reference:"community-mysql-8.0.18-1.fc30")) flag++;
    
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_WARNING,
        extra      : rpm_report_get()
      );
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "community-mysql");
    }
    
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-4195-1.NASL
    descriptionMultiple security issues were discovered in MySQL and this update includes new upstream MySQL versions to fix these issues. MySQL has been updated to 8.0.18 in Ubuntu 19.10. Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 19.04 have been updated to MySQL 5.7.28. In addition to security fixes, the updated packages contain bug fixes, new features, and possibly incompatible changes. Please see the following for more information: https://dev.mysql.com/doc/relnotes/mysql/5.7/en/news-5-7-28.html https://dev.mysql.com/doc/relnotes/mysql/8.0/en/news-8-0-18.html https://www.oracle.com/security-alerts/cpuoct2019.html Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id131161
    published2019-11-20
    reporterUbuntu Security Notice (C) 2019 Canonical, Inc. / NASL script (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/131161
    titleUbuntu 16.04 LTS / 18.04 LTS / 19.04 / 19.10 : mysql-5.7, mysql-8.0 vulnerabilities (USN-4195-1)
  • NASL familyDatabases
    NASL idMARIADB_10_3_19.NASL
    descriptionThe version of MariaDB installed on the remote host is 10.3.x prior to 10.3.19. It is, therefore, affected by multiple denial of service vulnerabilities: - Multiple denial of service vulnerabilities exists in the following Oracle MySQL components: InnoDB, Optimizer and PS. An authenticated, remote attacker can exploit this issue, to cause a hang or frequently repeatable crash of MySQL Server. (CVE-2019-2938, CVE-2019-2974)
    last seen2020-05-31
    modified2019-12-13
    plugin id132054
    published2019-12-13
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/132054
    titleMariaDB 10.3.x < 10.3.19 Multiple Denial of Service Vulnerabilities
  • NASL familyDatabases
    NASL idMYSQL_8_0_18.NASL
    descriptionThe version of MySQL running on the remote host is 8.0.x prior to 8.0.18. It is, therefore, affected by multiple vulnerabilities, including three of the top vulnerabilities below, as noted in the October 2019 Critical Patch Update advisory: - Vulnerabilities in the MySQL Server product of Oracle MySQL (components: Server: C API and Optimizer). Easily exploitable vulnerabilities which allow low privileged attackers with network access via multiple protocols to compromise MySQL Server. Successful exploitation of these vulnerabilities can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2019-2966, CVE-2019-3011) - A non-privileged user or program can put code and a config file in a known non-privileged path (under C:/usr/local/) that will make curl <= 7.65.1 automatically run the code (as an openssl
    last seen2020-05-08
    modified2019-10-18
    plugin id130027
    published2019-10-18
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/130027
    titleMySQL 8.0.x < 8.0.18 Multiple Vulnerabilities (Oct 2019 CPU)
  • NASL familyDatabases
    NASL idMARIADB_10_2_28.NASL
    descriptionThe version of MariaDB installed on the remote host is 10.2.x prior to 10.2.28. It is, therefore, affected by multiple denial of service vulnerabilities: - Multiple denial of service vulnerabilities exists in the following Oracle MySQL components: InnoDB, Optimizer and PS. An authenticated, remote attacker can exploit this issue, to cause a hang or frequently repeatable crash of MySQL Server. (CVE-2019-2938, CVE-2019-2974) Note that Nessus has not tested for this issue but has instead relied only on the application
    last seen2020-05-31
    modified2019-12-13
    plugin id132051
    published2019-12-13
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/132051
    titleMariaDB 10.2.x < 10.2.28 Multiple Denial of Service Vulnerabilities
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-4195-2.NASL
    descriptionUSN-4195-1 fixed multiple vulnerabilities in MySQL. This update provides the corresponding fixes for CVE-2019-2974 in MariaDB 10.1 and CVE-2019-2938, CVE-2019-2974 for MariaDB 10.3. Ubuntu 18.04 LTS has been updated to MariaDB 10.1.43. Ubuntu 19.04 and 19.10 has been updated to MariaDB 10.3.20. In addition to security fixes, the updated package contain bug fixes, new features, and possibly incompatible changes. Please see the following for more information: https://mariadb.com/kb/en/library/mariadb-10143-changelog/ https://mariadb.com/kb/en/library/mariadb-10143-release-notes/ https://mariadb.com/kb/en/library/mariadb-10320-changelog/ https://mariadb.com/kb/en/library/mariadb-10320-release-notes/ Original advisory details : Multiple security issues were discovered in MySQL and this update includes new upstream MySQL versions to fix these issues. MySQL has been updated to 8.0.18 in Ubuntu 19.10. Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 19.04 have been updated to MySQL 5.7.28. In addition to security fixes, the updated packages contain bug fixes, new features, and possibly incompatible changes. Please see the following for more information: https://dev.mysql.com/doc/relnotes/mysql/5.7/en/news-5-7-28. html https://dev.mysql.com/doc/relnotes/mysql/8.0/en/news-8-0-18. html https://www.oracle.com/security-alerts/cpuoct2019.html Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id131182
    published2019-11-21
    reporterUbuntu Security Notice (C) 2019 Canonical, Inc. / NASL script (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/131182
    titleUbuntu 18.04 LTS / 19.04 / 19.10 : mariadb vulnerabilities (USN-4195-2)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2019-3369-1.NASL
    descriptionThis update for mariadb to version 10.2.29 fixes the following issues : MariaDB was updated to 10.2.29 (bsc#1156669) Security issues fixed : CVE-2019-2737: Fixed an issue where could lead a remote attacker to cause denial of service CVE-2019-2938: Fixed an issue where could lead a remote attacker to cause denial of service CVE-2019-2740: Fixed an issue where could lead a local attacker to cause denial of service CVE-2019-2805: Fixed an issue where could lead a local attacker to cause denial of service CVE-2019-2974: Fixed an issue where could lead a remote attacker to cause denial of service CVE-2019-2758: Fixed an issue where could lead a local attacker to cause denial of service or data corruption CVE-2019-2739: Fixed an issue where could lead a local attacker to cause denial of service or data corruption Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id132387
    published2019-12-23
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/132387
    titleSUSE SLED12 / SLES12 Security Update : mariadb (SUSE-SU-2019:3369-1)
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2019-2698.NASL
    descriptionThis update for mariadb to version 10.2.29 fixes the following issues : MariaDB was updated to 10.2.29 (bsc#1156669) Security issues fixed : - CVE-2019-2737: Fixed an issue where could lead a remote attacker to cause denial of service - CVE-2019-2938: Fixed an issue where could lead a remote attacker to cause denial of service - CVE-2019-2740: Fixed an issue where could lead a local attacker to cause denial of service - CVE-2019-2805: Fixed an issue where could lead a local attacker to cause denial of service - CVE-2019-2974: Fixed an issue where could lead a remote attacker to cause denial of service - CVE-2019-2758: Fixed an issue where could lead a local attacker to cause denial of service or data corruption - CVE-2019-2739: Fixed an issue where could lead a local attacker to cause denial of service or data corruption This update was imported from the SUSE:SLE-15:Update update project.
    last seen2020-06-01
    modified2020-06-02
    plugin id132385
    published2019-12-23
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/132385
    titleopenSUSE Security Update : mariadb (openSUSE-2019-2698)
  • NASL familyPhotonOS Local Security Checks
    NASL idPHOTONOS_PHSA-2020-3_0-0082_MYSQL.NASL
    descriptionAn update of the mysql package has been released.
    last seen2020-05-08
    modified2020-04-22
    plugin id135872
    published2020-04-22
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/135872
    titlePhoton OS 3.0: Mysql PHSA-2020-3.0-0082
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2019-3306-1.NASL
    descriptionThis update for mariadb to version 10.2.29 fixes the following issues : MariaDB was updated to 10.2.29 (bsc#1156669) Security issues fixed : CVE-2019-2737: Fixed an issue where could lead a remote attacker to cause denial of service CVE-2019-2938: Fixed an issue where could lead a remote attacker to cause denial of service CVE-2019-2740: Fixed an issue where could lead a local attacker to cause denial of service CVE-2019-2805: Fixed an issue where could lead a local attacker to cause denial of service CVE-2019-2974: Fixed an issue where could lead a remote attacker to cause denial of service CVE-2019-2758: Fixed an issue where could lead a local attacker to cause denial of service or data corruption CVE-2019-2739: Fixed an issue where could lead a local attacker to cause denial of service or data corruption Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id132088
    published2019-12-17
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/132088
    titleSUSE SLED15 / SLES15 Security Update : mariadb (SUSE-SU-2019:3306-1)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2019-D40DF38271.NASL
    description**MySQL 8.0.18** Release notes : https://dev.mysql.com/doc/relnotes/mysql/8.0/en/news-8-0-18.html CVEs fixed : CVE-2019-2911 CVE-2019-2914 CVE-2019-2938 CVE-2019-2946 CVE-2019-2957 CVE-2019-2960 CVE-2019-2963 CVE-2019-2966 CVE-2019-2967 CVE-2019-2968 CVE-2019-2974 CVE-2019-2982 CVE-2019-2991 CVE-2019-2993 CVE-2019-2997 CVE-2019-2998 CVE-2019-3004 CVE-2019-3009 CVE-2019-3011 CVE-2019-3018 https://bugzilla.redhat.com/show_bug.cgi?id=1768175 https://www.oracle.com/security-alerts/cpuoct2019.html Maintainer notes : linking with GOLD disabled on armv7hl, because of https://bugs.mysql.com/bug.php?id=96698 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id130799
    published2019-11-12
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/130799
    titleFedora 31 : community-mysql (2019-d40df38271)
  • NASL familyDatabases
    NASL idMARIADB_10_4_9.NASL
    descriptionThe version of MariaDB installed on the remote host is 10.4.x prior to 10.4.9. It is, therefore, affected by multiple denial of service vulnerabilities: - Multiple denial of service vulnerabilities exists in the following Oracle MySQL components: InnoDB, Optimizer and PS. An authenticated, remote attacker can exploit this issue, to cause a hang or frequently repeatable crash of MySQL Server. (CVE-2019-2938, CVE-2019-2974)
    last seen2020-05-31
    modified2019-12-13
    plugin id132050
    published2019-12-13
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/132050
    titleMariaDB 10.4.x < 10.4.9 Multiple Denial of Service Vulnerabilities
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_FC91F2EFFD7B11E9A1C7B499BAEBFEAF.NASL
    descriptionOracle reports : This Critical Patch Update contains 31 new security fixes for Oracle MySQL. 6 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials.
    last seen2020-06-01
    modified2020-06-02
    plugin id130496
    published2019-11-04
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/130496
    titleFreeBSD : MySQL -- Multiple vulerabilities (fc91f2ef-fd7b-11e9-a1c7-b499baebfeaf)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2019-C1FAB3F139.NASL
    description**MySQL 8.0.18** Release notes : https://dev.mysql.com/doc/relnotes/mysql/8.0/en/news-8-0-18.html CVEs fixed : CVE-2019-2911 CVE-2019-2914 CVE-2019-2938 CVE-2019-2946 CVE-2019-2957 CVE-2019-2960 CVE-2019-2963 CVE-2019-2966 CVE-2019-2967 CVE-2019-2968 CVE-2019-2974 CVE-2019-2982 CVE-2019-2991 CVE-2019-2993 CVE-2019-2997 CVE-2019-2998 CVE-2019-3004 CVE-2019-3009 CVE-2019-3011 CVE-2019-3018 https://bugzilla.redhat.com/show_bug.cgi?id=1768175 https://www.oracle.com/security-alerts/cpuoct2019.html Maintainer notes : linking with GOLD disabled on armv7hl, because of https://bugs.mysql.com/bug.php?id=96698 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id130795
    published2019-11-12
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/130795
    titleFedora 29 : community-mysql (2019-c1fab3f139)
  • NASL familyPhotonOS Local Security Checks
    NASL idPHOTONOS_PHSA-2020-1_0-0284_MYSQL.NASL
    descriptionAn update of the mysql package has been released.
    last seen2020-03-27
    modified2020-03-24
    plugin id134835
    published2020-03-24
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/134835
    titlePhoton OS 1.0: Mysql PHSA-2020-1.0-0284
  • NASL familyDatabases
    NASL idMYSQL_5_7_28.NASL
    descriptionThe version of MySQL running on the remote host is 5.7.x prior to 5.7.28. It is, therefore, affected by multiple vulnerabilities, including three of the top vulnerabilities below, as noted in the October 2019 Critical Patch Update advisory: - Vulnerabilities in the MySQL Server product of Oracle MySQL (component: Server: Optimizer and PS). Easily exploitable vulnerabilities which allow low privileged attackers with network access via multiple protocols to compromise MySQL Server. Successful exploitation of these vulnerabilities can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2019-2946, CVE-2019-2974) - A non-privileged user or program can put code and a config file in a known non-privileged path (under C:/usr/local/) that will make curl <= 7.65.1 automatically run the code (as an openssl
    last seen2020-05-08
    modified2019-10-18
    plugin id130026
    published2019-10-18
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/130026
    titleMySQL 5.7.x < 5.7.28 Multiple Vulnerabilities (Oct 2019 CPU)
  • NASL familyAmazon Linux Local Security Checks
    NASL idALA_ALAS-2020-1333.NASL
    descriptionVulnerability in the MySQL Server product of Oracle MySQL (component: Information Schema). Supported versions that are affected are 5.6.45 and prior, 5.7.27 and prior and 8.0.17 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Server accessible data. CVSS 3.0 Base Score 2.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N).(CVE-2019-2911) Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Encryption). Supported versions that are affected are 5.7.27 and prior and 8.0.17 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).(CVE-2019-2914) Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.27 and prior and 8.0.17 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).(CVE-2019-2938) Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: PS). Supported versions that are affected are 5.7.27 and prior and 8.0.17 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).(CVE-2019-2946) Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 5.7.27 and prior and 8.0.17 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).(CVE-2019-2960) Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 5.6.45 and prior, 5.7.27 and prior and 8.0.17 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).(CVE-2019-2974) Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: C API). Supported versions that are affected are 5.7.27 and prior and 8.0.17 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H).(CVE-2019-2993)
    last seen2020-06-01
    modified2020-06-02
    plugin id132757
    published2020-01-10
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/132757
    titleAmazon Linux AMI : mysql57 (ALAS-2020-1333)