PT-2020-3331 · Oracle+8 · Mysql Server+7

Published 2020-07-14 · Updated 2023-05-17 · CVE-2020-14678

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Oracle MySQL versions 8.0.20 and prior

Description The issue is related to insufficient input validation in the Server: Security: Privileges component of Oracle MySQL, allowing a high-privileged attacker with network access via multiple protocols to compromise the MySQL Server. Successful attacks can result in the takeover of the MySQL Server. The vulnerability can be exploited remotely and may lead to a complete denial of service (DOS) of the MySQL Server, including the ability to cause a hang or frequently repeatable crash.

Recommendations For versions 8.0.20 and prior, update to a version later than 8.0.20 to resolve the issue. At the moment, there is no information about additional mitigation measures for this vulnerability.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALSA-2020:3732

ALT-PU-2020-2640

ALT-PU-2021-2380

ALT-PU-2021-3668

BDU:2020-03644

CESA-2020_3732

CVE-2020-14678

RHSA-2020:3518

RHSA-2020:3732

RHSA-2020:3755

RHSA-2020:3757

RHSA-2020_3732

RLSA-2020:3732

USN-4441-1

USN-4441-2

Affected Products

Alt Linux

Almalinux

Centos

Linuxmint

Mysql Server

Red Hat

Rocky Linux

Ubuntu

References · 265

• 🔥 https://github.com/terorie/cve-2021-3449 · Exploit
• 🔥 https://github.com/riptl/cve-2021-3449 · Exploit
• 🔥 https://github.com/motikan2010/CVE-2020-5398 · Exploit
• 🔥 https://github.com/LeadroyaL/cve-2019-14540-exploit · Exploit
• 🔥 https://github.com/irsl/CVE-2020-1967 · Exploit
• 🔥 https://github.com/MBHudson/CVE-2020-1971 · Exploit
• https://security.gentoo.org/glsa/202105-27 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-14632 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-14641 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-14678 · Security Note
• https://ubuntu.com/security/CVE-2020-14591 · Vendor Advisory
• https://errata.almalinux.org/8/ALSA-2020-3732.html · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4441-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-14643 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-14550 · Vendor Advisory