PT-2020-12480 · Percona · Percona Xtradb Cluster

Published 2020-04-27 · Updated 2022-04-26 · CVE-2020-10996

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Percona XtraDB Cluster versions prior to 5.7.28-31.41.2 Percona XtraDB Cluster versions prior to 5.7.28-31.42

Description An issue was discovered where a bundled script inadvertently sets a static transition key for SST processes instead of the expected random key.

Recommendations For Percona XtraDB Cluster versions prior to 5.7.28-31.41.2, update to version 5.7.28-31.41.2 or later. For Percona XtraDB Cluster versions prior to 5.7.28-31.42, update to version 5.7.28-31.42 or later.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-838

CWE-798

Related Identifiers

CVE-2020-10996

Affected Products

Percona Xtradb Cluster

References · 9

• https://percona.com/doc/percona-xtradb-cluster/LATEST/release-notes/Percona-XtraDB-Cluster-5.7.28-31.41.2.html · Vendor Advisory
• https://jira.percona.com/browse/PXC-3117 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-10996 · Vendor Advisory
• https://percona.com/blog/2020/04/20/cve-2020-10996-percona-xtradb-cluster-sst-script-static-key · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-10996 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-10996 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-10996 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-10996 · Vendor Advisory
• https://t.me/cvenotify/3227 · Telegram Post