PT-2017-11505 · Mysql Server+3 · Dbd::Mysql+3

Pali · Published 2017-07-01 · Updated 2025-04-07 · CVE-2017-10789

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions DBD::mysql versions through 4.043

Description The issue allows man-in-the-middle attackers to spoof servers via a cleartext-downgrade attack. This occurs because the mysql ssl=1 setting is used to mean that SSL is optional, despite the documentation stating that communication with the server will be encrypted.

Recommendations For DBD::mysql versions through 4.043, consider disabling the use of the mysql ssl=1 setting until a patch is available, and instead, enforce SSL encryption for all connections to prevent cleartext-downgrade attacks.

Fix

Related Identifiers

ALT-PU-2018-1256

CVE-2017-10789

DLA-1079-1

MGASA-2018-0031

MGASA-2018-0283

OPENSUSE-SU-2018_1463-1

OPENSUSE-SU-2024:11160-1

SUSE-SU-2018:1449-1

SUSE-SU-2018:1450-1

USN-5344-1

USN-7417-1

Affected Products

Alt Linux

Dbd::Mysql

Suse

Ubuntu

References · 39

• https://osv.dev/vulnerability/SUSE-SU-2018:1449-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/NY3AHSF4ZPQQ5OGYZYNQOD7TBL7CAG4F · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-10789 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2018:1450-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2018-0283 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11160-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-10789 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-10789 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/7BLHU5FAHMKZBZ4LAHIASWUJVK4O6JS6 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7417-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5344-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2018-0283.html · Security Note
• https://debian.org/security/2016/dsa-3684 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2018-0031.html · Security Note
• https://ubuntu.com/security/notices/USN-7417-1 · Vendor Advisory