kritisch
CVE-2020-15180
mariadb: Insufficient SST method name check leading to code injection in mysql-wsrep
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.
Einstufung nach Quelle
NVD9.0CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Red Hat9.0CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Bitnami9.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD, Bitnami. Niedriger laut Red Hat (hoch), AlmaLinux (hoch), Oracle (hoch), Rocky Linux (hoch), Ubuntu (mittel).
Beschreibung
A flaw was found in the mysql-wsrep component of mariadb. Lack of input sanitization in `wsrep_sst_method` allows for command injection that can be exploited by a remote attacker to execute arbitrary commands on galera cluster nodes. This threatens the system's confidentiality, integrity, and availability. This flaw affects mariadb versions before 10.1.47, before 10.2.34, before 10.3.25, before 10.4.15 and before 10.5.6.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | mariadb, mariadb-min, mysql-client | 10.1.47, 10.2.34, 10.3.25, 10.4.15, 10.5.6 |
| alma 8 | mariadb:10.5::Judy | 1.0.5-18.module_el8.5.0+2632+14ced695 |
| alpine 3.10 | mariadb | 10.3.25-r0 |
| alpine 3.11 | mariadb | 10.4.15-r0 |
| alpine 3.12 | mariadb | 10.4.15-r0 |
| alpine 3.13 | mariadb | 10.5.6-r0 |
| alpine 3.14 | mariadb | 10.5.6-r0 |
| alpine 3.15 | mariadb | 10.5.6-r0 |
| alpine 3.16 | mariadb | 10.5.6-r0 |
| alpine 3.17 | mariadb | 10.5.6-r0 |
| alpine 3.18 | mariadb | 10.5.6-r0 |
| alpine 3.19 | mariadb | 10.5.6-r0 |
Alle 47 Einträge aus 29 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | mariadb | 10.1.47, 10.2.34, 10.3.25, 10.4.15, 10.5.6 |
| bitnami::Bitnami Vulnerability Database | mariadb-min | 10.1.47, 10.2.34, 10.3.25, 10.4.15, 10.5.6 |
| bitnami::Bitnami Vulnerability Database | mysql-client | 10.1.47, 10.2.34, 10.3.25, 10.4.15, 10.5.6 |
| alma 8 | mariadb:10.5::Judy | 1.0.5-18.module_el8.5.0+2632+14ced695 |
| alpine 3.10 | mariadb | 10.3.25-r0 |
| alpine 3.11 | mariadb | 10.4.15-r0 |
| alpine 3.12 | mariadb | 10.4.15-r0 |
| alpine 3.13 | mariadb | 10.5.6-r0 |
| alpine 3.14 | mariadb | 10.5.6-r0 |
| alpine 3.15 | mariadb | 10.5.6-r0 |
| alpine 3.16 | mariadb | 10.5.6-r0 |
| alpine 3.17 | mariadb | 10.5.6-r0 |
| alpine 3.18 | mariadb | 10.5.6-r0 |
| alpine 3.19 | mariadb | 10.5.6-r0 |
| alpine 3.20 | mariadb | 10.5.6-r0 |
| alpine 3.21 | mariadb | 10.5.6-r0 |
| alpine 3.22 | mariadb | 10.5.6-r0 |
| alpine 3.23 | mariadb | 10.5.6-r0 |
| alpine 3.24 | mariadb | 10.5.6-r0 |
| alpine 3.9 | mariadb | 10.3.25-r0 |
| alpine edge | mariadb | 10.5.6-r0 |
| debian 10 | mariadb-10.3 | 1:10.3.25-0+deb10u1 |
| debian 11 | mariadb-10.5 | 1:10.5.6-1 |
| debian 9 | mariadb-10.1 | 10.1.47-0+deb9u1 |
| Oracle Linux 8 | Judy | 1.0.5-18.module+el8.1.0+5402+691bd77e |
| Oracle Linux 8 | Judy-devel | 1.0.5-18.module+el8.1.0+5402+691bd77e |
| Oracle Linux 8 | asio-devel | 1.10.8-7.module+el8.1.0+5402+691bd77e |
| Oracle Linux 8 | galera | 25.3.31-1.module+el8.3.0+7885+7a81225f |
| Oracle Linux 8 | mariadb | 3:10.3.27-3.module+el8.3.0+7885+7a81225f |
| Oracle Linux 8 | mariadb-backup | 3:10.3.27-3.module+el8.3.0+7885+7a81225f |
| Oracle Linux 8 | mariadb-common | 3:10.3.27-3.module+el8.3.0+7885+7a81225f |
| Oracle Linux 8 | mariadb-devel | 3:10.3.27-3.module+el8.3.0+7885+7a81225f |
| Oracle Linux 8 | mariadb-embedded | 3:10.3.27-3.module+el8.3.0+7885+7a81225f |
| Oracle Linux 8 | mariadb-embedded-devel | 3:10.3.27-3.module+el8.3.0+7885+7a81225f |
| Oracle Linux 8 | mariadb-errmsg | 3:10.3.27-3.module+el8.3.0+7885+7a81225f |
| Oracle Linux 8 | mariadb-gssapi-server | 3:10.3.27-3.module+el8.3.0+7885+7a81225f |
| Oracle Linux 8 | mariadb-oqgraph-engine | 3:10.3.27-3.module+el8.3.0+7885+7a81225f |
| Oracle Linux 8 | mariadb-server | 3:10.3.27-3.module+el8.3.0+7885+7a81225f |
| Oracle Linux 8 | mariadb-server-galera | 3:10.3.27-3.module+el8.3.0+7885+7a81225f |
| Oracle Linux 8 | mariadb-server-utils | 3:10.3.27-3.module+el8.3.0+7885+7a81225f |
| Oracle Linux 8 | mariadb-test | 3:10.3.27-3.module+el8.3.0+7885+7a81225f |
| rocky 8 | mariadb:10.3::Judy | 1.0.5-18.module+el8.4.0+427+adf35707 |
| root.io debian 11 | rootio-mariadb-10.5 | 1:10.5.6-1 |
| ubuntu 18.04 | mariadb-10.1 | 1:10.1.47-0ubuntu0.18.04.1 |
| ubuntu 18.04-ESM | mariadb-10.1 | 1:10.1.47-0ubuntu0.18.04.1 |
| ubuntu 20.04 | mariadb-10.3 | 1:10.3.25-0ubuntu0.20.04.1 |
| ubuntu 20.04-ESM | mariadb-10.3 | 1:10.3.25-0ubuntu0.20.04.1 |
Referenzen
- https://access.redhat.com/security/cve/CVE-2020-15180
- https://bugzilla.redhat.com/show_bug.cgi?id=1764680
- https://bugzilla.redhat.com/show_bug.cgi?id=1764691
- https://bugzilla.redhat.com/show_bug.cgi?id=1798587
- https://bugzilla.redhat.com/show_bug.cgi?id=1830056
- https://bugzilla.redhat.com/show_bug.cgi?id=1830059
- https://bugzilla.redhat.com/show_bug.cgi?id=1830060
- https://bugzilla.redhat.com/show_bug.cgi?id=1830082
Alle 49 Referenzen
- https://bugzilla.redhat.com/show_bug.cgi?id=1835849
- https://bugzilla.redhat.com/show_bug.cgi?id=1839827
- https://bugzilla.redhat.com/show_bug.cgi?id=1890738
- https://bugzilla.redhat.com/show_bug.cgi?id=1890743
- https://bugzilla.redhat.com/show_bug.cgi?id=1890747
- https://bugzilla.redhat.com/show_bug.cgi?id=1890756
- https://bugzilla.redhat.com/show_bug.cgi?id=1894919
- https://bugzilla.redhat.com/show_bug.cgi?id=1899009
- https://bugzilla.redhat.com/show_bug.cgi?id=1899017
- https://bugzilla.redhat.com/show_bug.cgi?id=1899021
- https://bugzilla.redhat.com/show_bug.cgi?id=1899082
- https://bugzilla.redhat.com/show_bug.cgi?id=1899086
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-2938
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-2974
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13249
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14765
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14776
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14789
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14812
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15180
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-2574
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-2752
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-2760
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-2780
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-2812
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-2814
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-2022
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-2144
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-2194
- https://errata.almalinux.org/8/ALSA-2020-5500.html
- https://errata.rockylinux.org/RLSA-2020:5500
- https://linux.oracle.com/cve/CVE-2020-15180.html
- https://linux.oracle.com/errata/ELSA-2020-5500.html
- https://lists.debian.org/debian-lts-announce/2020/10/msg00021.html
- https://mariadb.com/kb/en/security/
- https://nvd.nist.gov/vuln/detail/CVE-2020-15180
- https://security.gentoo.org/glsa/202011-14
- https://ubuntu.com/security/notices/USN-4603-1
- https://www.cve.org/CVERecord?id=CVE-2020-15180
- https://www.debian.org/security/2020/dsa-4776
- https://www.percona.com/blog/2020/10/30/cve-2020-15180-affects-percona-xtradb-cluster/