PT-2022-18132 · Percona · Percona Xtrabackup

Published 2022-06-02 · Updated 2024-03-06 · CVE-2022-26944

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Percona XtraBackup version 2.4.20

Description The issue allows sensitive information, such as command line arguments, to be written to backup files and the PERCONA SCHEMA.xtrabackup history table when the --history option is used. This may expose sensitive data passed at runtime.

Recommendations For Percona XtraBackup version 2.4.20, consider avoiding the use of sensitive arguments at runtime or refrain from using the --history option until a fix is available. As a temporary workaround, restrict access to the backup files and the PERCONA SCHEMA.xtrabackup history table to minimize the risk of sensitive information exposure.

Fix

Related Identifiers

BIT-PERCONA-XTRABACKUP-2022-26944

BIT-PERCONA-XTRABACKUP-BINARY-2022-26944

CVE-2022-26944

Affected Products

Percona Xtrabackup

References · 7

• https://jira.percona.com/browse/PXB-2722 · Vendor Advisory
• https://docs.percona.com/percona-xtrabackup/2.4/release-notes/2.4/2.4.25.html · Vendor Advisory
• https://osv.dev/vulnerability/BIT-percona-xtrabackup-binary-2022-26944 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-26944 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-26944 · Security Note
• https://osv.dev/vulnerability/BIT-percona-xtrabackup-2022-26944 · Vendor Advisory
• https://t.me/cibsecurity/43762 · Telegram Post