Critical Denial of Service Vulnerability in MariaDB - CVE-2020-2814
Summary
ALPINE-CVE-2020-2814: Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Affects mariadb versions < 10.3.23-r0. Fixed in 10.3.23-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MariaDB is an open-source relational database management system that is widely used for web applications and data storage. It is a fork of MySQL and offers enhanced features, performance improvements, and a strong community support. This vulnerability, identified as CVE-2020-2814, affects various versions of MariaDB across multiple Alpine Linux distributions, allowing high-privileged attackers to exploit the database server.
Vulnerability Detail
CVE-2020-2814 is a vulnerability in the MySQL Server product of Oracle MySQL, specifically affecting the InnoDB component. The vulnerability allows a high-privileged attacker with network access to compromise the MySQL Server, leading to a denial of service (DoS) condition. The affected versions include MariaDB 5.6.47 and prior, 5.7.28 and prior, and 8.0.18 and prior. The CVSS score for this vulnerability is 4.9, indicating a moderate risk with potential availability impacts.
How To Fix
Minimum fixed version
10.3.23-r0
This is the first release that contains the fix.
sudo apk add --upgrade mariadbTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider restricting network access to the MariaDB server to trusted IP addresses only. This can be done by configuring the firewall rules to limit access to the database server.
Conclusion
CVE-2020-2814 poses a significant risk to MariaDB installations, allowing attackers to exploit the vulnerability and cause service disruptions. It is crucial to update to the latest patched versions of the software and implement network access restrictions to mitigate potential risks.
See every vulnerability recorded for mariadb →
FAQ
CVE-2020-2814 is a vulnerability in the MySQL Server product that affects MariaDB, allowing high-privileged attackers to cause a denial of service.
Affected versions include MariaDB 5.6.47 and prior, 5.7.28 and prior, and 8.0.18 and prior.
The CVSS score for CVE-2020-2814 is 4.9, indicating a moderate risk level.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
Ensure you update to the latest patched version of MariaDB and restrict network access to trusted IPs as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for mariadb.
