Command Injection Vulnerability in MariaDB: CVE-2020-15180
Summary
ALPINE-CVE-2020-15180: A flaw was found in the mysql-wsrep component of mariadb. Affects mariadb versions < 10.3.25-r0. Fixed in 10.3.25-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MariaDB is an open-source relational database management system that is widely used for web applications and data storage. It is known for its high performance, scalability, and compatibility with MySQL. However, certain versions of MariaDB are vulnerable to a command injection flaw in the mysql-wsrep component, which can compromise the security of galera cluster nodes.
Vulnerability Detail
A flaw was found in the mysql-wsrep component of MariaDB due to a lack of input sanitization in the 'wsrep_sst_method'. This vulnerability allows remote attackers to execute arbitrary commands on galera cluster nodes, threatening the system's confidentiality, integrity, and availability. The affected versions include those prior to 10.1.47, 10.2.34, 10.3.25, 10.4.15, and 10.5.6.
How To Fix
Minimum fixed version
10.3.25-r0
This is the first release that contains the fix.
sudo apk add --upgrade mariadbTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not possible, consider disabling the wsrep_sst_method or restricting access to the database to trusted users only. Implementing network security measures such as firewalls can also help mitigate the risk.
Conclusion
The command injection vulnerability in MariaDB (CVE-2020-15180) poses a significant risk to systems using affected versions. It is crucial to update to the patched versions to safeguard against potential attacks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for mariadb →
FAQ
CVE-2020-15180 is a command injection vulnerability in the mysql-wsrep component of MariaDB that allows remote attackers to execute arbitrary commands.
Versions of MariaDB prior to 10.1.47, 10.2.34, 10.3.25, 10.4.15, and 10.5.6 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of this vulnerability is 9.0, indicating a high severity level.
If immediate patching is not feasible, consider disabling the wsrep_sst_method and implementing network security measures to restrict access.
References
Related vulnerabilities
Recent vulnerabilities recorded for mariadb.
