Improper input validation in MySQL Server - CVE-2020-2574

Vulnerability identifier: #VU25710

CSH Severity: Medium

CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-2574

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the C API component in MySQL Client. A remote non-authenticated attacker can exploit this vulnerability to perform a denial of service (DoS) attack.

MySQL Server
Gentoo Linux
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for x86_64
Anolis OS
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux Server - AUS
mariadb (Red Hat package)
Red Hat Enterprise Linux Server for x86_64 - Update Services for SAP Solutions
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
rh-mysql80-mysql (Red Hat package)
rh-mariadb102-mariadb (Red Hat package)
mariadb (Alpine package)
rh-mariadb102-galera (Red Hat package)
mariadb-connector-c-config
mariadb-connector-c-devel
mariadb-connector-c
mariadb-connector-c (Red Hat package)
rh-mariadb103-mariadb (Red Hat package)
rh-mariadb103-galera (Red Hat package)
Red Hat OpenShift Container Platform

Install updates from vendor's website.

MySQL Server - addressed in versions 5.6.47, 5.7.29, 8.0.19
mariadb (Red Hat package) - update to 5.5.68-1.el7
rh-mysql80-mysql (Red Hat package) - update to 8.0.21-1.el7
rh-mariadb102-mariadb (Red Hat package) - addressed in versions 10.2.33-1.el6, 10.2.33-1.el7
mariadb (Alpine package) - update to 10.2.31-r0
rh-mariadb102-galera (Red Hat package) - addressed in versions 25.3.29-1.el6, 25.3.29-1.el7
mariadb-connector-c-config - update to 3.1.11-2
mariadb-connector-c-devel - update to 3.1.11-2
mariadb-connector-c - update to 3.1.11-2
mariadb-connector-c (Red Hat package) - addressed in versions 3.1.11-2.el8_0, 3.1.11-2.el8_1, 3.1.11-2.el8_2, 3.1.11-2.el8_3
Red Hat OpenShift Container Platform - update to 4.3.40
rh-mariadb103-mariadb (Red Hat package) - update to 10.3.27-1.el7
rh-mariadb103-galera (Red Hat package) - update to 25.3.31-1.el7

• https://www.oracle.com/security-alerts/cpujan2020.html

• Multiple vulnerabilities in Oracle MySQL
• Red Hat Software Collections update for rh-mysql80-mysql
• Improper input validation in mariadb (Alpine package)
• Red Hat Enterprise Linux 7 update for mariadb
• Red Hat Software Collections update for rh-mariadb102-mariadb and rh-mariadb102-galera
• Red Hat Enterprise Linux 8 update for mariadb-connector-c
• Red Hat Enterprise Linux TUS 8.0 update for the mariadb:10.3 module
• Red Hat Enterprise Linux TUS 8.2 update for mariadb-connector-c
• Red Hat Enterprise Linux 8.1 update for mariadb-connector-c
• Red Hat Enterprise Linux 8 update for mariadb-connector-c
• Red Hat Enterprise Linux 8 update for the mariadb:10.3 module
• Red Hat Enterprise Linux 8.1 update for the mariadb:10.3 module
• Gentoo update for MySQL
• Red Hat Software Collections update for rh-mariadb103-mariadb and rh-mariadb103-galera
• Anolis OS update for mariadb-connector-c
• Red Hat Enterprise Linux 8 update for the mysql:8.0 module
• Red Hat Enterprise Linux 8 update for the mysql:8.0 module
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.3
• Red Hat Enterprise Linux 8 update for the mariadb:10.3 module