Bug 50156 - mariadb-10.1: Multiple issues (4.3)
mariadb-10.1: Multiple issues (4.3)
Status: CLOSED FIXED
Product: UCS
Classification: Unclassified
Component: Security updates
UCS 4.3
All Linux
: P3 normal (vote)
: UCS 4.3-4-errata
Assigned To: Quality Assurance
Philipp Hahn
:
Depends on:
Blocks: 50155
  Show dependency treegraph
 
Reported: 2019-09-09 15:47 CEST by Quality Assurance
Modified: 2019-09-11 15:56 CEST (History)
0 users

See Also:
What kind of report is it?: Security Issue
What type of bug is this?: ---
Who will be affected by this bug?: ---
How will those affected feel about the bug?: ---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Ticket number:
Bug group (optional):
Max CVSS v3 score: 6.5 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) NVD RedHat


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Quality Assurance univentionstaff 2019-09-09 15:47:53 CEST
New Debian mariadb-10.1 10.1.41-0+deb9u1 fixes:
This update addresses the following issues:
* Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent:  Server: Replication). Supported versions that are affected are 5.6.43 and  prior, 5.7.25 and prior and 8.0.15 and prior. Difficult to exploit  vulnerability allows high privileged attacker with network access via  multiple protocols to compromise MySQL Server. Successful attacks of this  vulnerability can result in unauthorized ability to cause a hang or  frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base  Score 4.4 (Availability impacts). CVSS Vector:  (CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H). (CVE-2019-2614)
* Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent:  Server: Security: Privileges). Supported versions that are affected are  5.6.43 and prior, 5.7.25 and prior and 8.0.15 and prior. Easily exploitable  vulnerability allows high privileged attacker with network access via  multiple protocols to compromise MySQL Server. Successful attacks of this  vulnerability can result in unauthorized ability to cause a hang or  frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base  Score 4.9 (Availability impacts). CVSS Vector:  (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). (CVE-2019-2627)
* Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent:  Server : Pluggable Auth). Supported versions that are affected are 5.6.44  and prior, 5.7.26 and prior and 8.0.16 and prior. Easily exploitable  vulnerability allows high privileged attacker with network access via  multiple protocols to compromise MySQL Server. Successful attacks of this  vulnerability can result in unauthorized ability to cause a hang or  frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base  Score 4.9 (Availability impacts). CVSS Vector:  (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). (CVE-2019-2737)
* Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent:  Server: Security: Privileges). Supported versions that are affected are  5.6.44 and prior, 5.7.26 and prior and 8.0.16 and prior. Easily exploitable  vulnerability allows high privileged attacker with logon to the  infrastructure where MySQL Server executes to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability  to cause a hang or frequently repeatable crash (complete DOS) of MySQL  Server as well as unauthorized update, insert or delete access to some of  MySQL Server accessible data. CVSS 3.0 Base Score 5.1 (Integrity and  Availability impacts). CVSS Vector:  (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H). (CVE-2019-2739)
* Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent:  Server: XML). Supported versions that are affected are 5.6.44 and prior,  5.7.26 and prior and 8.0.16 and prior. Easily exploitable vulnerability  allows low privileged attacker with network access via multiple protocols  to compromise MySQL Server. Successful attacks of this vulnerability can  result in unauthorized ability to cause a hang or frequently repeatable  crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability  impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).  (CVE-2019-2740)
* Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent:  Server: Parser). Supported versions that are affected are 5.6.44 and prior,  5.7.26 and prior and 8.0.16 and prior. Easily exploitable vulnerability  allows low privileged attacker with network access via multiple protocols  to compromise MySQL Server. Successful attacks of this vulnerability can  result in unauthorized ability to cause a hang or frequently repeatable  crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability  impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).  (CVE-2019-2805)
Comment 1 Quality Assurance univentionstaff 2019-09-09 17:00:36 CEST
--- mirror/ftp/4.3/unmaintained/component/4.3-4-errata/source/mariadb-10.1_10.1.38-0+deb9u1.dsc
+++ apt/ucs_4.3-0-errata4.3-4/source/mariadb-10.1_10.1.41-0+deb9u1.dsc
@@ -1,3 +1,19 @@
+10.1.41-0+deb9u1 [Fri, 02 Aug 2019 18:10:23 +0100] Otto Kekäläinen <otto@debian.org>:
+
+  * SECURITY UPDATE: New upstream version 10.1.41. Includes fixes for the
+    following security vulnerabilities:
+    - CVE-2019-2737
+    - CVE-2019-2739
+    - CVE-2019-2740
+    - CVE-2019-2805
+  * Previous release 10.1.39
+    includes fixes for the following security vulnerabilities:
+    - CVE-2019-2627
+    - CVE-2019-2614
+  * Amend previous changelog entries to include newly released CVE numbers.
+  * Gitlab-CI: Sync latest version from Debian Sid but with Stretch adaptions
+  * Uses respolveip from correct path as per upstream fix (Closes: #928758)
+
 10.1.38-0+deb9u1 [Tue, 16 Apr 2019 14:56:50 +0300] Otto Kekäläinen <otto@debian.org>:
 
   * SECURITY UPDATE: New upstream release 10.1.38. Includes fixes for

<http://10.200.17.11/4.3-4/#2598165946144244767>
Comment 2 Philipp Hahn univentionstaff 2019-09-10 11:34:52 CEST
OK: yaml
OK: announce_errata
OK: patch
~OK: piuparts
 unclean upstream

[4.3-4] b735c8de49 Bug #50156: mariadb-10.1 10.1.41-0+deb9u1
 doc/errata/staging/mariadb-10.1.yaml | 83 +++++++++++++-----------------------
 1 file changed, 29 insertions(+), 54 deletions(-)

[4.3-4] 2c03c80267 Bug #50156: mariadb-10.1 10.1.41-0+deb9u1
 doc/errata/staging/mariadb-10.1.yaml | 72 ++++++++++++++++++++++++++++++++++++
 1 file changed, 72 insertions(+)
Comment 3 Erik Damrose univentionstaff 2019-09-11 15:56:14 CEST
<http://errata.software-univention.de/ucs/4.3/584.html>