OS Command Injection in MariaDB - CVE-2020-15180

Vulnerability identifier: #VU49122

CSH Severity: High

CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-15180

CWE-ID: CWE-78

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation within the wsrep_sst_method method in the mysql-wsrep component of mariadb. A remote unauthenticated attacker can pass specially crafted data to the application and execute arbitrary OS commands on galera cluster node.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

MariaDB
Debian Linux
Gentoo Linux
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux Server - TUS
Ubuntu
openEuler
Fedora
mariadb (Alpine package)
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
Red Hat Enterprise Linux Server for x86_64 - Update Services for SAP Solutions
mariadb-server (Ubuntu package)
mariadb-errmessage
mariadb-embedded-devel
mariadb-debuginfo
mariadb-backup
mariadb-server-galera
mariadb-devel
mariadb-server
mariadb-gssapi-server
mariadb-embedded
mariadb-oqgraph-engine
mariadb-debugsource
mariadb-cracklib
mariadb-common
mariadb
mariadb-test
mariadb-10.3 (Debian package)
rh-mariadb103-mariadb (Red Hat package)
dev-db/mariadb
rh-mariadb103-galera (Red Hat package)

Install updates from vendor's website.

MariaDB - addressed in versions 10.1.47, 10.2.34, 10.3.25, 10.4.15, 10.5.6
mariadb (Alpine package) - update to 10.5.6-r0
mariadb-server (Ubuntu package) - addressed in versions 1:10.1.47-0ubuntu0.18.04.1, 1:10.3.25-0ubuntu0.20.04.1
mariadb-errmessage - update to 10.3.9-11
mariadb-embedded-devel - update to 10.3.9-11
mariadb-debuginfo - update to 10.3.9-11
mariadb-backup - update to 10.3.9-11
mariadb-server-galera - update to 10.3.9-11
mariadb-devel - update to 10.3.9-11
mariadb-server - update to 10.3.9-11
mariadb-gssapi-server - update to 10.3.9-11
mariadb-embedded - update to 10.3.9-11
mariadb-oqgraph-engine - update to 10.3.9-11
mariadb-debugsource - update to 10.3.9-11
mariadb-cracklib - update to 10.3.9-11
mariadb-common - update to 10.3.9-11
mariadb - update to 10.3.9-11
mariadb-test - update to 10.3.9-11
mariadb-10.3 (Debian package) - update to 1:10.3.25-0+deb10u1
rh-mariadb103-mariadb (Red Hat package) - update to 10.3.27-1.el7
mariadb - addressed in versions 10.3-3120201106115457.f636be4b, 10.3-3220201106115457.43bbeeef, 10.3-3220201112123416.43bbeeef, 10.3-3320201106115457.601d93de, 10.3-3320201112123416.601d93de
dev-db/mariadb - update to 10.5.6
rh-mariadb103-galera (Red Hat package) - update to 25.3.31-1.el7

• https://bugzilla.redhat.com/show_bug.cgi?id=1894919

• Remote command execution in MariaDB
• Red Hat Enterprise Linux TUS 8.0 update for the mariadb:10.3 module
• Red Hat Enterprise Linux 8 update for the mariadb:10.3 module
• Red Hat Enterprise Linux 8.1 update for the mariadb:10.3 module
• OS Command Injection in mariadb (Alpine package)
• Debian update for mariadb-10.3
• Red Hat Software Collections update for rh-mariadb103-mariadb and rh-mariadb103-galera
• openEuler 20.03 LTS SP1 update for mariadb
• Ubuntu update for mariadb-10.1
• Gentoo update for MariaDB
• Red Hat Enterprise Linux 8 update for the mariadb:10.3 module
• Fedora 33 Modular update for mariadb
• Fedora 31 Modular update for mariadb
• Fedora 32 Modular update for mariadb
• Fedora 32 Modular update for mariadb
• Fedora 33 Modular update for mariadb