Critical Vulnerability in MariaDB: CVE-2018-2787 - Denial of Service and Unauthorized Data Access
Summary
ALPINE-CVE-2018-2787: Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Affects mariadb versions < 10.2.15-r0. Fixed in 10.2.15-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MariaDB is an open-source relational database management system that is widely used for web applications and data storage. It is a fork of MySQL and offers enhanced features, performance improvements, and a more open development process. The vulnerability CVE-2018-2787 affects MariaDB versions prior to 10.2.15-r0, allowing high-privileged attackers with network access to exploit the system, leading to potential denial of service and unauthorized data manipulation.
Vulnerability Detail
CVE-2018-2787 is a vulnerability in the MySQL Server component of Oracle MySQL, specifically in the InnoDB subcomponent. It affects supported versions 5.6.39 and prior, and 5.7.21 and prior. The vulnerability allows an attacker with high privileges and network access to compromise the MySQL Server, resulting in a denial of service (DoS) through server hangs or crashes, and unauthorized access to update, insert, or delete data. The CVSS 3.0 Base Score for this vulnerability is 5.5, indicating moderate severity with impacts on integrity and availability.
How To Fix
Minimum fixed version
10.2.15-r0
This is the first release that contains the fix.
sudo apk add --upgrade mariadbTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider restricting network access to the MariaDB server to trusted IP addresses only, thereby limiting exposure to potential attackers. Additionally, ensure that your database user permissions are set correctly to minimize the risk of unauthorized access.
Conclusion
CVE-2018-2787 presents a significant risk to MariaDB installations, allowing for denial of service and unauthorized data manipulation. It is crucial to update to the patched version 10.2.15-r0 or later to mitigate these risks. Users should also consider implementing network restrictions and reviewing permissions as interim measures.
See every vulnerability recorded for mariadb →
FAQ
CVE-2018-2787 is a vulnerability in the MySQL Server component of Oracle MySQL that affects MariaDB, allowing attackers to cause a denial of service and unauthorized data access.
MariaDB versions prior to 10.2.15-r0 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of CVE-2018-2787 is 5.5, indicating a moderate severity level.
If immediate updating is not possible, restrict network access to the MariaDB server and review user permissions to minimize potential risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for mariadb.
