PT-2017-6471 · Percona+1 · Percona-Toolkit+2

David Busby · Published 2017-09-28 · Updated 2024-06-15 · CVE-2015-1027

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions percona-toolkit versions prior to 2.2.13 xtrabackup versions prior to 2.2.9

Description The issue allows for silent HTTP downgrade attacks and Man In The Middle attacks. In these attacks, the server response can be modified, enabling the attacker to respond with a modified command payload. This can lead to the client returning additional running configuration information, resulting in an information disclosure of the running configuration of MySQL.

Recommendations For percona-toolkit versions prior to 2.2.13, update to version 2.2.13 or later. For xtrabackup versions prior to 2.2.9, update to version 2.2.9 or later.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2015-1027

OPENSUSE-SU-2024:10095-1

OPENSUSE-SU-2024:10120-1

Affected Products

Mysql Server

Percona-Toolkit

Xtrabackup

References · 14

• 🔥 https://percona.com/blog/2015/05/06/percona-security-advisory-cve-2015-1027 · Exploit
• https://ubuntu.com/security/CVE-2015-1027 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2015-1027 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2015-1027 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10120-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10095-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-1027 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-1027 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-1027 · Security Note
• https://osv.dev/vulnerability/CVE-2015-1027 · Vendor Advisory
• https://suse.com/security/cve/CVE-2013-6394 · Note
• https://suse.com/security/cve/CVE-2015-1027 · Note
• https://bugs.launchpad.net/percona-toolkit/+bug/1408375 · Note
• https://suse.com/security/cve/CVE-2014-2029 · Note