PT-2019-3707 · Oracle+7 · Oracle Hospitality Reporting/Analytics+7

Published 2019-08-09 · Updated 2023-01-31 · CVE-2019-2950

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions MySQL Server versions 8.0.16 and prior Oracle Hospitality Reporting and Analytics (affected versions not specified)

Description The issue is related to inadequate access control in the Server: Optimizer component of MySQL Server and the Oracle Hospitality Reporting and Analytics package. Exploitation of this issue may allow a remote attacker to cause a hang or crash of the MySQL Server using the network MySQL protocol or gain unauthorized access to protected data via the HTTP protocol.

Recommendations For MySQL Server versions 8.0.16 and prior: update to a version that addresses the access control issue in the Server: Optimizer component. For Oracle Hospitality Reporting and Analytics: at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-264

Related Identifiers

ALSA-2019:2511

ALT-PU-2019-2432

ALT-PU-2020-1827

BDU:2019-03933

BDU:2019-03934

CESA-2019_2511

CVE-2019-2950

RHSA-2019:2484

RHSA-2019:2511

RHSA-2019_2511

RLSA-2019:2511

USN-4195-1

Affected Products

Alt Linux

Almalinux

Centos

Mysql Server

Oracle Hospitality Reporting/Analytics

Red Hat

Rocky Linux

Ubuntu

References · 656

• https://ubuntu.com/security/CVE-2019-3018 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-2898 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-2593 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-2892 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-2740 · Security Note
• https://bdu.fstec.ru/vul/2020-02583 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-2531 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-2922 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-2695 · Security Note
• https://bdu.fstec.ru/vul/2021-02461 · Security Note
• https://osv.dev/vulnerability/CVE-2019-2950 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-2910 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-2991 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-2812 · Security Note
• https://bdu.fstec.ru/vul/2020-02379 · Security Note