PT-2020-12481 · Percona · Percona Xtrabackup

Zsolt Paragi · Published 2020-04-27 · Updated 2024-03-06 · CVE-2020-10997

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Percona XtraBackup versions prior to 2.4.20

Description The issue allows sensitive information to be unintentionally written to backup files and the PERCONA SCHEMA.xtrabackup history table when the --history option is used. This may include sensitive arguments passed at runtime.

Recommendations For Percona XtraBackup versions prior to 2.4.20, update to version 2.4.20 or later to resolve the issue. As a temporary workaround, consider avoiding the use of sensitive arguments when running Percona XtraBackup, and refrain from using the --history option until the update is applied.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BIT-PERCONA-XTRABACKUP-2020-10997

BIT-PERCONA-XTRABACKUP-BINARY-2020-10997

CVE-2020-10997

OPENSUSE-SU-2022:10212-1

Affected Products

Percona Xtrabackup

References · 16

• https://osv.dev/vulnerability/BIT-percona-xtrabackup-2020-10997 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-10997 · Security Note
• https://jira.percona.com/browse/PXB-2142 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2022:10212-1 · Vendor Advisory
• https://percona.com/blog/2020/04/16/cve-2020-10997-percona-xtrabackup-information-disclosure-of-command-line-arguments · Vendor Advisory
• https://osv.dev/vulnerability/BIT-percona-xtrabackup-binary-2020-10997 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-10997 · Vendor Advisory
• https://suse.com/security/cve/CVE-2020-10997 · Note
• https://bugzilla.suse.com/1205581 · Note
• https://t.me/cibsecurity/43762 · Telegram Post
• https://bugzilla.suse.com/1135095 · Note
• https://bugzilla.suse.com/1125418 · Note
• https://lists.opensuse.org/archives/list/[e-mail]/thread/U3RTDTIXGJ3RCHKJUZNBA3BXYPTFKTB7 · Note
• https://suse.com/security/cve/CVE-2020-29488 · Note
• https://bugzilla.suse.com/1170644 · Note