PT-2017-8935 · Percona · Percona Xtrabackup

Ken Takara · Published 2017-03-23 · Updated 2018-10-30 · CVE-2016-6225

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Percona XtraBackup versions prior to 2.3.6 Percona XtraBackup versions 2.4.x prior to 2.4.5

Description The issue arises from the improper setting of the initialization vector (IV) for encryption in xbcrypt, making it easier for attackers to obtain sensitive information from encrypted backup files via a Chosen-Plaintext attack.

Recommendations For Percona XtraBackup versions prior to 2.3.6, update to version 2.3.6 or later. For Percona XtraBackup versions 2.4.x prior to 2.4.5, update to version 2.4.5 or later.

Fix

Inadequate Encryption Strength

Weakness Enumeration

CWE-326

Related Identifiers

CVE-2016-6225

Affected Products

Percona Xtrabackup

References · 13

• https://github.com/percona/percona-xtrabackup/pull/267 · Patch
• https://github.com/percona/percona-xtrabackup/pull/266 · Patch
• https://percona.com/blog/2017/01/12/cve-2016-6225-percona-xtrabackup-encryption-iv-not-set-properly · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-6225 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-6225 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-6225 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBVCP6KLFVGG6HSGLHLTMZRD6C4IJSZP · Vendor Advisory
• https://bugs.launchpad.net/percona-xtrabackup/+bug/1643949 · Patch
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BAHI6ETS22FJCMLW7A6SICFKQXF5G2VI · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-6225 · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2017-01/msg00126.html · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-6225 · Security Note
• http://lists.opensuse.org/opensuse-updates/2017-01/msg00125.html · Vendor Advisory