PT-2020-4506 · Mysql Server+3 · Mysql Server+3

Published 2020-10-20 · Updated 2022-01-04 · CVE-2020-14878

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MySQL Server versions 8.0.21 and prior

Description The issue is related to insufficient input validation in the Server: Security: LDAP Auth component of the MySQL Server. This can be exploited by an attacker to compromise the MySQL Server, potentially leading to a takeover. The vulnerability can be exploited by an attacker with access to the physical communication segment or remotely via the MySQL protocol. Successful attacks can result in the unauthorized ability to cause a hang or crash of the MySQL Server.

Recommendations For versions 8.0.21 and prior, update to a version later than 8.0.21 to resolve the issue. As a temporary workaround, consider restricting access to the LDAP Auth component until a patch is available. Avoid using the MySQL protocol to minimize the risk of exploitation until the issue is resolved.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALT-PU-2020-3284

ALT-PU-2021-2380

ALT-PU-2021-3668

BDU:2020-05055

CVE-2020-14878

USN-4604-1

Affected Products

Alt Linux

Linuxmint

Mysql Server

Ubuntu

References · 65

• 🔥 https://github.com/riptl/cve-2021-3449 · Exploit
• 🔥 https://github.com/terorie/cve-2021-3449 · Exploit
• 🔥 https://github.com/motikan2010/CVE-2020-5398 · Exploit
• 🔥 https://github.com/LeadroyaL/cve-2019-14540-exploit · Exploit
• 🔥 https://github.com/irsl/CVE-2020-1967 · Exploit
• 🔥 https://github.com/MBHudson/CVE-2020-1971 · Exploit
• https://ubuntu.com/security/CVE-2020-14867 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-14829 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-14878 · Vendor Advisory
• https://security.gentoo.org/glsa/202105-27 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-14830 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-14791 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-14869 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-14773 · Vendor Advisory
• https://oracle.com/security-alerts/cpuoct2020.html · Vendor Advisory