PT-2017-5839 · Percona+1 · Percona-Toolkit+1

Published 2014-03-06 · Updated 2024-06-15 · CVE-2014-2029

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Percona Toolkit version 2.1

Description: The automatic version check functionality in Percona Toolkit allows man-in-the-middle attackers to obtain sensitive information or execute arbitrary code. This is possible due to the use of HTTP to download configuration information from v.percona.com, which makes it vulnerable to interception and manipulation.

Recommendations: For Percona Toolkit version 2.1, consider disabling the automatic version check functionality as a temporary workaround until a patch is available. Restrict access to sensitive information and configuration downloads to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2014-2029

OPENSUSE-SU-2014_0333-1

OPENSUSE-SU-2024:10095-1

OPENSUSE-SU-2024:10120-1

Affected Products

Percona-Toolkit

Suse

References · 19

• https://osv.dev/vulnerability/openSUSE-SU-2024:10095-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2014-2029 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2014-2029 · Security Note
• https://osv.dev/vulnerability/CVE-2014-2029 · Vendor Advisory
• https://bugzilla.novell.com/show_bug.cgi?id=864194 · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2024:10120-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-2029 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-2029 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-2029 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2014-2029 · Vendor Advisory
• http://support.novell.com/security/cve/CVE-2014-2029.html · Note
• https://suse.com/security/cve/CVE-2014-2029 · Note
• http://openwall.com/lists/oss-security/2014/02/19/14 · Note
• http://openwall.com/lists/oss-security/2014/02/18/4 · Note
• https://bugs.launchpad.net/percona-toolkit/+bug/1279502 · Note