PT-2020-2407 · Oracle+6 · Mysql Server+5

Julien Ahrens · Published 2020-02-14 · Updated 2021-12-30 · CVE-2020-2779

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Oracle MySQL Server versions 8.0.18 and prior

Description The issue is related to insufficient access control in the privileges system of Oracle MySQL Server, allowing a remote attacker to cause a denial of service via the MySQL network protocol. This can result in the ability to cause a hang or frequently repeatable crash of MySQL Server. The estimated number of potentially affected devices is not provided.

Recommendations For versions 8.0.18 and prior, update to a version that includes the fix for this issue to prevent exploitation. As a temporary workaround, consider restricting network access to the MySQL Server to minimize the risk of exploitation. Restrict access to the Server: Security: Privileges component to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

ALSA-2020:3732

ALT-PU-2020-1220

ALT-PU-2020-1827

BDU:2020-02379

CESA-2020_3732

CVE-2020-2779

RHSA-2020:3518

RHSA-2020:3732

RHSA-2020:3755

RHSA-2020:3757

RHSA-2020_3732

RLSA-2020:3732

Affected Products

Alt Linux

Almalinux

Centos

Mysql Server

Red Hat

Rocky Linux

References · 227

• https://security.gentoo.org/glsa/202105-27 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-2779 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/77REFDB7DE4WNKQIRGZTF53RFBQOXQLC · Vendor Advisory
• https://oracle.com/security-alerts/cpuapr2020.html · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-2779 · Vendor Advisory
• https://errata.almalinux.org/8/ALSA-2020-3732.html · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SDGBQYS3A36S4CAZPV5YROHYXYZR6LAH · Vendor Advisory
• https://osv.dev/vulnerability/RLSA-2020:3732 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2020:3732 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-02379 · Security Note
• https://ubuntu.com/security/CVE-2020-2779 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TSVLI36TYRTPQGCS24VZQUXCUFOUW4VQ · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2020-3732.html · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2020:3732 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-2779 · Security Note