crítica
CVE-2020-15180
mariadb: Insufficient SST method name check leading to code injection in mysql-wsrep
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.0CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Red Hat9.0CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Bitnami9.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD, Bitnami. Más baja según Red Hat (alta), AlmaLinux (alta), Oracle (alta), Rocky Linux (alta), Ubuntu (media).
Descripción
A flaw was found in the mysql-wsrep component of mariadb. Lack of input sanitization in `wsrep_sst_method` allows for command injection that can be exploited by a remote attacker to execute arbitrary commands on galera cluster nodes. This threatens the system's confidentiality, integrity, and availability. This flaw affects mariadb versions before 10.1.47, before 10.2.34, before 10.3.25, before 10.4.15 and before 10.5.6.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | mariadb, mariadb-min, mysql-client | 10.1.47, 10.2.34, 10.3.25, 10.4.15, 10.5.6 |
| alma 8 | mariadb:10.5::Judy | 1.0.5-18.module_el8.5.0+2632+14ced695 |
| alpine 3.10 | mariadb | 10.3.25-r0 |
| alpine 3.11 | mariadb | 10.4.15-r0 |
| alpine 3.12 | mariadb | 10.4.15-r0 |
| alpine 3.13 | mariadb | 10.5.6-r0 |
| alpine 3.14 | mariadb | 10.5.6-r0 |
| alpine 3.15 | mariadb | 10.5.6-r0 |
| alpine 3.16 | mariadb | 10.5.6-r0 |
| alpine 3.17 | mariadb | 10.5.6-r0 |
| alpine 3.18 | mariadb | 10.5.6-r0 |
| alpine 3.19 | mariadb | 10.5.6-r0 |
Mostrar las 47 entradas de 29 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | mariadb | 10.1.47, 10.2.34, 10.3.25, 10.4.15, 10.5.6 |
| bitnami::Bitnami Vulnerability Database | mariadb-min | 10.1.47, 10.2.34, 10.3.25, 10.4.15, 10.5.6 |
| bitnami::Bitnami Vulnerability Database | mysql-client | 10.1.47, 10.2.34, 10.3.25, 10.4.15, 10.5.6 |
| alma 8 | mariadb:10.5::Judy | 1.0.5-18.module_el8.5.0+2632+14ced695 |
| alpine 3.10 | mariadb | 10.3.25-r0 |
| alpine 3.11 | mariadb | 10.4.15-r0 |
| alpine 3.12 | mariadb | 10.4.15-r0 |
| alpine 3.13 | mariadb | 10.5.6-r0 |
| alpine 3.14 | mariadb | 10.5.6-r0 |
| alpine 3.15 | mariadb | 10.5.6-r0 |
| alpine 3.16 | mariadb | 10.5.6-r0 |
| alpine 3.17 | mariadb | 10.5.6-r0 |
| alpine 3.18 | mariadb | 10.5.6-r0 |
| alpine 3.19 | mariadb | 10.5.6-r0 |
| alpine 3.20 | mariadb | 10.5.6-r0 |
| alpine 3.21 | mariadb | 10.5.6-r0 |
| alpine 3.22 | mariadb | 10.5.6-r0 |
| alpine 3.23 | mariadb | 10.5.6-r0 |
| alpine 3.24 | mariadb | 10.5.6-r0 |
| alpine 3.9 | mariadb | 10.3.25-r0 |
| alpine edge | mariadb | 10.5.6-r0 |
| debian 10 | mariadb-10.3 | 1:10.3.25-0+deb10u1 |
| debian 11 | mariadb-10.5 | 1:10.5.6-1 |
| debian 9 | mariadb-10.1 | 10.1.47-0+deb9u1 |
| Oracle Linux 8 | Judy | 1.0.5-18.module+el8.1.0+5402+691bd77e |
| Oracle Linux 8 | Judy-devel | 1.0.5-18.module+el8.1.0+5402+691bd77e |
| Oracle Linux 8 | asio-devel | 1.10.8-7.module+el8.1.0+5402+691bd77e |
| Oracle Linux 8 | galera | 25.3.31-1.module+el8.3.0+7885+7a81225f |
| Oracle Linux 8 | mariadb | 3:10.3.27-3.module+el8.3.0+7885+7a81225f |
| Oracle Linux 8 | mariadb-backup | 3:10.3.27-3.module+el8.3.0+7885+7a81225f |
| Oracle Linux 8 | mariadb-common | 3:10.3.27-3.module+el8.3.0+7885+7a81225f |
| Oracle Linux 8 | mariadb-devel | 3:10.3.27-3.module+el8.3.0+7885+7a81225f |
| Oracle Linux 8 | mariadb-embedded | 3:10.3.27-3.module+el8.3.0+7885+7a81225f |
| Oracle Linux 8 | mariadb-embedded-devel | 3:10.3.27-3.module+el8.3.0+7885+7a81225f |
| Oracle Linux 8 | mariadb-errmsg | 3:10.3.27-3.module+el8.3.0+7885+7a81225f |
| Oracle Linux 8 | mariadb-gssapi-server | 3:10.3.27-3.module+el8.3.0+7885+7a81225f |
| Oracle Linux 8 | mariadb-oqgraph-engine | 3:10.3.27-3.module+el8.3.0+7885+7a81225f |
| Oracle Linux 8 | mariadb-server | 3:10.3.27-3.module+el8.3.0+7885+7a81225f |
| Oracle Linux 8 | mariadb-server-galera | 3:10.3.27-3.module+el8.3.0+7885+7a81225f |
| Oracle Linux 8 | mariadb-server-utils | 3:10.3.27-3.module+el8.3.0+7885+7a81225f |
| Oracle Linux 8 | mariadb-test | 3:10.3.27-3.module+el8.3.0+7885+7a81225f |
| rocky 8 | mariadb:10.3::Judy | 1.0.5-18.module+el8.4.0+427+adf35707 |
| root.io debian 11 | rootio-mariadb-10.5 | 1:10.5.6-1 |
| ubuntu 18.04 | mariadb-10.1 | 1:10.1.47-0ubuntu0.18.04.1 |
| ubuntu 18.04-ESM | mariadb-10.1 | 1:10.1.47-0ubuntu0.18.04.1 |
| ubuntu 20.04 | mariadb-10.3 | 1:10.3.25-0ubuntu0.20.04.1 |
| ubuntu 20.04-ESM | mariadb-10.3 | 1:10.3.25-0ubuntu0.20.04.1 |
Referencias
- https://access.redhat.com/security/cve/CVE-2020-15180
- https://bugzilla.redhat.com/show_bug.cgi?id=1764680
- https://bugzilla.redhat.com/show_bug.cgi?id=1764691
- https://bugzilla.redhat.com/show_bug.cgi?id=1798587
- https://bugzilla.redhat.com/show_bug.cgi?id=1830056
- https://bugzilla.redhat.com/show_bug.cgi?id=1830059
- https://bugzilla.redhat.com/show_bug.cgi?id=1830060
- https://bugzilla.redhat.com/show_bug.cgi?id=1830082
Las 49 referencias
- https://bugzilla.redhat.com/show_bug.cgi?id=1835849
- https://bugzilla.redhat.com/show_bug.cgi?id=1839827
- https://bugzilla.redhat.com/show_bug.cgi?id=1890738
- https://bugzilla.redhat.com/show_bug.cgi?id=1890743
- https://bugzilla.redhat.com/show_bug.cgi?id=1890747
- https://bugzilla.redhat.com/show_bug.cgi?id=1890756
- https://bugzilla.redhat.com/show_bug.cgi?id=1894919
- https://bugzilla.redhat.com/show_bug.cgi?id=1899009
- https://bugzilla.redhat.com/show_bug.cgi?id=1899017
- https://bugzilla.redhat.com/show_bug.cgi?id=1899021
- https://bugzilla.redhat.com/show_bug.cgi?id=1899082
- https://bugzilla.redhat.com/show_bug.cgi?id=1899086
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-2938
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-2974
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13249
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14765
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14776
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14789
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14812
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15180
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-2574
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-2752
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-2760
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-2780
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-2812
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-2814
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-2022
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-2144
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-2194
- https://errata.almalinux.org/8/ALSA-2020-5500.html
- https://errata.rockylinux.org/RLSA-2020:5500
- https://linux.oracle.com/cve/CVE-2020-15180.html
- https://linux.oracle.com/errata/ELSA-2020-5500.html
- https://lists.debian.org/debian-lts-announce/2020/10/msg00021.html
- https://mariadb.com/kb/en/security/
- https://nvd.nist.gov/vuln/detail/CVE-2020-15180
- https://security.gentoo.org/glsa/202011-14
- https://ubuntu.com/security/notices/USN-4603-1
- https://www.cve.org/CVERecord?id=CVE-2020-15180
- https://www.debian.org/security/2020/dsa-4776
- https://www.percona.com/blog/2020/10/30/cve-2020-15180-affects-percona-xtradb-cluster/