PT-2017-8935 · Percona · Percona Xtrabackup

Ken Takara · Publicado 2017-03-23 · Atualizado 2018-10-30 · CVE-2016-6225

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Percona XtraBackup versions prior to 2.3.6 Percona XtraBackup versions 2.4.x prior to 2.4.5

Description The issue arises from the improper setting of the initialization vector (IV) for encryption in xbcrypt, making it easier for attackers to obtain sensitive information from encrypted backup files via a Chosen-Plaintext attack.

Recommendations For Percona XtraBackup versions prior to 2.3.6, update to version 2.3.6 or later. For Percona XtraBackup versions 2.4.x prior to 2.4.5, update to version 2.4.5 or later.

Correção

Inadequate Encryption Strength

Enumeração de Fraquezas

CWE-326

Identificadores relacionados

CVE-2016-6225

Produtos afetados

Percona Xtrabackup

Referências · 13

• https://github.com/percona/percona-xtrabackup/pull/267 · Correção
• https://github.com/percona/percona-xtrabackup/pull/266 · Correção
• https://percona.com/blog/2017/01/12/cve-2016-6225-percona-xtrabackup-encryption-iv-not-set-properly · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-6225 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2016-6225 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-6225 · Nota de Segurança
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBVCP6KLFVGG6HSGLHLTMZRD6C4IJSZP · Aviso do Fabricante
• https://bugs.launchpad.net/percona-xtrabackup/+bug/1643949 · Correção
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BAHI6ETS22FJCMLW7A6SICFKQXF5G2VI · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2016-6225 · Aviso do Fabricante
• http://lists.opensuse.org/opensuse-updates/2017-01/msg00126.html · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2016-6225 · Nota de Segurança
• http://lists.opensuse.org/opensuse-updates/2017-01/msg00125.html · Aviso do Fabricante