Critical Vulnerability in MariaDB: Denial of Service Risk and Unauthorized Data Access
Summary
ALPINE-CVE-2020-2760: Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Affects mariadb versions < 10.3.23-r0. Fixed in 10.3.23-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MariaDB is an open-source relational database management system that is widely used for web applications and data storage. It is a fork of MySQL and offers enhanced features, performance improvements, and a strong community support. However, certain versions of MariaDB are vulnerable to a critical security issue that can lead to denial of service and unauthorized access to data.
Vulnerability Detail
The vulnerability, identified as CVE-2020-2760, affects the MySQL Server component of Oracle MySQL, which is also relevant to MariaDB. It allows a high-privileged attacker with network access to exploit the vulnerability via multiple protocols. Successful exploitation can result in a denial of service (DoS) by causing the MySQL Server to hang or crash, as well as unauthorized updates, inserts, or deletions of data. The affected versions include MariaDB prior to 10.3.23 and 10.4.13, with a CVSS score of 5.5 indicating moderate severity.
How To Fix
Minimum fixed version
10.3.23-r0
This is the first release that contains the fix.
sudo apk add --upgrade mariadbTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider restricting network access to the MariaDB server to trusted IP addresses only. This can be done by configuring the firewall rules to limit access to the database server.
Conclusion
CVE-2020-2760 represents a significant security risk for users of MariaDB, allowing for potential denial of service and unauthorized data manipulation. It is crucial to update to the latest patched versions to mitigate these risks effectively.
See every vulnerability recorded for mariadb →
FAQ
CVE-2020-2760 is a vulnerability in the MySQL Server product that affects MariaDB, allowing attackers to cause a denial of service and unauthorized access to data.
Affected versions include MariaDB prior to 10.3.23 for v3.10 and prior to 10.4.13 for v3.11 and later versions.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The vulnerability can lead to denial of service, causing the MySQL Server to hang or crash, and unauthorized access to modify data.
The CVSS score for CVE-2020-2760 is 5.5, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for mariadb.
