PT-2020-1501 · Mysql Server+6 · Mysql Client+6

Alves Christopher + 6 · Published 2020-01-14 · Updated 2021-12-30 · CVE-2020-2570

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MySQL Client versions 5.7.28 and prior MySQL Client versions 8.0.18 and prior

Description The issue is related to insufficient access control in the MySQL Client's C API, which can be exploited by a remote attacker to cause a denial of service using the MySQL network protocol. This can result in the ability to cause a hang or frequently repeatable crash of the MySQL Client, leading to a complete denial of service.

Recommendations For versions 5.7.28 and prior, update to a version later than 5.7.28 to resolve the issue. For versions 8.0.18 and prior, update to a version later than 8.0.18 to resolve the issue.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

ALSA-2020:3732

ALT-PU-2020-1220

ALT-PU-2020-1827

BDU:2020-00484

CESA-2020_3732

CVE-2020-2570

RHSA-2020:3518

RHSA-2020:3732

RHSA-2020:3755

RHSA-2020:3757

RHSA-2020_3732

RLSA-2020:3732

USN-4250-1

Affected Products

Alt Linux

Almalinux

Centos

Mysql Client

Red Hat

Rocky Linux

Ubuntu

References · 239

• https://security.gentoo.org/glsa/202105-27 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-2588 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-2570 · Vendor Advisory
• https://errata.almalinux.org/8/ALSA-2020-3732.html · Vendor Advisory
• https://osv.dev/vulnerability/RLSA-2020:3732 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2020:3732 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-2577 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-2627 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-2584 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-2570 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-2579 · Vendor Advisory
• https://usn.ubuntu.com/4250-1 · Vendor Advisory
• https://oracle.com/security-alerts/cpujan2020.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-2572 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-2570 · Vendor Advisory