PT-2020-16399 · Mysql Server · Dbdeployer

Smowton · Published 2020-12-21 · Updated 2024-08-21 · CVE-2020-26277

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions DBdeployer versions prior to 1.58.2

Description DBdeployer is a tool that deploys MySQL database servers easily. Users unpacking a tarball may use a maliciously packaged tarball that contains symlinks to files external to the target. In such a scenario, an attacker could induce DBdeployer to write into a system file, thus altering the computer defenses. For the attack to succeed, the following factors need to contribute: the user is logged in as root, and the user has taken a tarball from a non-secure source without testing the checksum.

Recommendations For versions prior to 1.58.2, update to version 1.58.2 to fix the issue. As a temporary workaround, consider verifying the checksum of the tarball before attempting to unpack it, and avoid running DBdeployer as root. Restrict access to system files and directories to minimize the risk of exploitation.

Fix

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

CVE-2020-26277

GHSA-47WR-426J-FR82

GO-2022-0787

Affected Products

Dbdeployer

References · 7

• https://github.com/datacharmer/dbdeployer/commit/548e256c1de2f99746e861454e7714ec6bc9bb10 · Patch
• https://osv.dev/vulnerability/CVE-2020-26277 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-26277 · Security Note
• https://osv.dev/vulnerability/GO-2022-0787 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-47wr-426j-fr82 · Vendor Advisory
• https://github.com/datacharmer/dbdeployer/security/advisories/GHSA-47wr-426j-fr82 · Note
• https://t.me/cibsecurity/21149 · Telegram Post