Vulnerability in MySQL Server component of Oracle MySQL
Summary
CVE-2019-2739: Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Privileges). Affects mariadb across 2 version ranges.
>= 5bfe1a3917ee1bddc7f2cde0c88961875148873c, < cc37250a76472de4021bdfb395a17a9e736aecf6
< 10.3.17-r0
Fixed in 10.3.17-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The MySQL Server is a popular open-source relational database management system. It is widely used for storing and managing data in various applications. The vulnerability identified in this report affects versions 5.6.44 and prior, 5.7.26 and prior, and 8.0.16 and prior of the MySQL Server. This vulnerability specifically impacts the Server: Security: Privileges component of MySQL Server. The vulnerability allows a high privileged attacker with logon access to the infrastructure where MySQL Server executes to compromise the server. Successful exploitation of this vulnerability can lead to unauthorized access to MySQL Server data, as well as causing a hang or frequently repeatable crash of the server.
Vulnerability Detail
The vulnerability (CVE-2019-2739) in the MySQL Server component of Oracle MySQL allows a high privileged attacker with logon access to compromise the server. This vulnerability can be easily exploited and has a CVSS 3.0 Base Score of 5.1, indicating moderate severity. The impact of this vulnerability includes unauthorized ability to cause a hang or frequently repeatable crash (complete denial of service) of the MySQL Server, as well as unauthorized update, insert, or delete access to some of the accessible data. The vulnerability affects multiple versions of MySQL Server, including 5.6.44 and prior, 5.7.26 and prior, and 8.0.16 and prior.
How To Fix
Minimum fixed version
10.3.17-r0
This is the first release that contains the fix.
sudo apk add --upgrade mariadbTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is recommended to follow the steps mentioned in the 'how_to_fix' section to upgrade to the fixed versions of MySQL Server.
Conclusion
The vulnerability in the MySQL Server component of Oracle MySQL (CVE-2019-2739) can be exploited by a high privileged attacker to compromise the server. It is important to upgrade to the fixed versions of MySQL Server to mitigate the risk of unauthorized access and denial of service. Regularly updating and patching MySQL Server is crucial for maintaining the security of the system. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mariadb →
FAQ
The impact of this vulnerability includes unauthorized ability to cause a hang or frequently repeatable crash (complete denial of service) of the MySQL Server, as well as unauthorized update, insert, or delete access to some of the accessible data.
The vulnerability affects versions 5.6.44 and prior, 5.7.26 and prior, and 8.0.16 and prior of MySQL Server.
To fix this vulnerability, it is recommended to upgrade to the fixed versions of MySQL Server. For versions 5.6.44 and prior, upgrade to a version later than 5.6.44. For versions 5.7.26 and prior, upgrade to a version later than 5.7.26. For versions 8.0.16 and prior, upgrade to a version later than 8.0.16.
There is no specific workaround mentioned for this vulnerability. It is recommended to follow the steps mentioned in the 'how_to_fix' section to upgrade to the fixed versions of MySQL Server.
The CVSS 3.0 Base Score of this vulnerability is 5.1, indicating moderate severity.
Related vulnerabilities
Recent vulnerabilities recorded for mariadb.
