Input validation error - CVE-2018-3173
Published: October 17, 2018 / Updated: August 4, 2020
Vulnerability identifier: #VU33746
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-3173
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote privileged user to perform a denial of service (DoS) attack.
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Supported versions that are affected are 5.7.23 and prior and 8.0.12 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
Affected software
mariadb (Alpine package)
mariadb
Opensuse
Fedora
mariadb
Opensuse
Fedora
How to mitigate CVE-2018-3173
Install update from vendor's website.
mariadb (Alpine package) - update to 10.1.37-r0
mariadb - addressed in versions 10.2.19-1.fc27, 10.2.19-1.fc28, 10.3.11-1.fc29
mariadb - addressed in versions 10.2.19-1.fc27, 10.2.19-1.fc28, 10.3.11-1.fc29
External References
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- http://www.securityfocus.com/bid/105594
- http://www.securitytracker.com/id/1041888
- https://access.redhat.com/errata/RHSA-2018:3655
- https://access.redhat.com/errata/RHSA-2019:1258
- https://security.gentoo.org/glsa/201908-24
- https://security.netapp.com/advisory/ntap-20181018-0002/
- https://usn.ubuntu.com/3799-1/