PT-2020-3587 · Mysql Server+5 · Mysql Server+5

Published 2020-04-28 · Updated 2022-07-01 · CVE-2020-14567

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions MySQL Server versions 5.7.29 and prior MySQL Server versions 8.0.19 and prior

Description The issue is related to insufficient input validation in the MySQL Server:Replication component, allowing a remote attacker to cause a hang or crash of the MySQL Server via the MySQL protocol. Successful attacks can result in unauthorized ability to cause a denial of service.

Recommendations For MySQL Server versions 5.7.29 and prior, update to a version later than 5.7.29 to resolve the issue. For MySQL Server versions 8.0.19 and prior, update to a version later than 8.0.19 to resolve the issue. As a temporary workaround, consider restricting network access to the MySQL Server to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALSA-2020:3732

ALT-PU-2020-1885

ALT-PU-2020-1904

BDU:2020-03921

CESA-2020_3732

CVE-2020-14567

RHSA-2020:3518

RHSA-2020:3732

RHSA-2020:3755

RHSA-2020:3757

RHSA-2020_3732

RLSA-2020:3732

Affected Products

Alt Linux

Almalinux

Centos

Mysql Server

Red Hat

Rocky Linux

References · 224

• https://security.gentoo.org/glsa/202105-27 · Vendor Advisory
• https://errata.almalinux.org/8/ALSA-2020-3732.html · Vendor Advisory
• https://osv.dev/vulnerability/RLSA-2020:3732 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2020:3732 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-14567 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-14567 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-03921 · Security Note
• https://cve.org/CVERecord?id=CVE-2020-14567 · Security Note
• https://oracle.com/security-alerts/cpujul2020.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-14567 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-14567 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2020-3732.html · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2020:3732 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1830056 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1796905 · Note