critique
CVE-2020-15180
mariadb: Insufficient SST method name check leading to code injection in mysql-wsrep
Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.
Sévérité par source
NVD9.0CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Red Hat9.0CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Bitnami9.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Le label propre à Trivy est CRITICAL. Critique selon NVD, Bitnami. Plus basse selon Red Hat (élevée), AlmaLinux (élevée), Oracle (élevée), Rocky Linux (élevée), Ubuntu (moyenne).
Description
A flaw was found in the mysql-wsrep component of mariadb. Lack of input sanitization in `wsrep_sst_method` allows for command injection that can be exploited by a remote attacker to execute arbitrary commands on galera cluster nodes. This threatens the system's confidentiality, integrity, and availability. This flaw affects mariadb versions before 10.1.47, before 10.2.34, before 10.3.25, before 10.4.15 and before 10.5.6.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | mariadb, mariadb-min, mysql-client | 10.1.47, 10.2.34, 10.3.25, 10.4.15, 10.5.6 |
| alma 8 | mariadb:10.5::Judy | 1.0.5-18.module_el8.5.0+2632+14ced695 |
| alpine 3.10 | mariadb | 10.3.25-r0 |
| alpine 3.11 | mariadb | 10.4.15-r0 |
| alpine 3.12 | mariadb | 10.4.15-r0 |
| alpine 3.13 | mariadb | 10.5.6-r0 |
| alpine 3.14 | mariadb | 10.5.6-r0 |
| alpine 3.15 | mariadb | 10.5.6-r0 |
| alpine 3.16 | mariadb | 10.5.6-r0 |
| alpine 3.17 | mariadb | 10.5.6-r0 |
| alpine 3.18 | mariadb | 10.5.6-r0 |
| alpine 3.19 | mariadb | 10.5.6-r0 |
Afficher les 47 entrées de 29 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | mariadb | 10.1.47, 10.2.34, 10.3.25, 10.4.15, 10.5.6 |
| bitnami::Bitnami Vulnerability Database | mariadb-min | 10.1.47, 10.2.34, 10.3.25, 10.4.15, 10.5.6 |
| bitnami::Bitnami Vulnerability Database | mysql-client | 10.1.47, 10.2.34, 10.3.25, 10.4.15, 10.5.6 |
| alma 8 | mariadb:10.5::Judy | 1.0.5-18.module_el8.5.0+2632+14ced695 |
| alpine 3.10 | mariadb | 10.3.25-r0 |
| alpine 3.11 | mariadb | 10.4.15-r0 |
| alpine 3.12 | mariadb | 10.4.15-r0 |
| alpine 3.13 | mariadb | 10.5.6-r0 |
| alpine 3.14 | mariadb | 10.5.6-r0 |
| alpine 3.15 | mariadb | 10.5.6-r0 |
| alpine 3.16 | mariadb | 10.5.6-r0 |
| alpine 3.17 | mariadb | 10.5.6-r0 |
| alpine 3.18 | mariadb | 10.5.6-r0 |
| alpine 3.19 | mariadb | 10.5.6-r0 |
| alpine 3.20 | mariadb | 10.5.6-r0 |
| alpine 3.21 | mariadb | 10.5.6-r0 |
| alpine 3.22 | mariadb | 10.5.6-r0 |
| alpine 3.23 | mariadb | 10.5.6-r0 |
| alpine 3.24 | mariadb | 10.5.6-r0 |
| alpine 3.9 | mariadb | 10.3.25-r0 |
| alpine edge | mariadb | 10.5.6-r0 |
| debian 10 | mariadb-10.3 | 1:10.3.25-0+deb10u1 |
| debian 11 | mariadb-10.5 | 1:10.5.6-1 |
| debian 9 | mariadb-10.1 | 10.1.47-0+deb9u1 |
| Oracle Linux 8 | Judy | 1.0.5-18.module+el8.1.0+5402+691bd77e |
| Oracle Linux 8 | Judy-devel | 1.0.5-18.module+el8.1.0+5402+691bd77e |
| Oracle Linux 8 | asio-devel | 1.10.8-7.module+el8.1.0+5402+691bd77e |
| Oracle Linux 8 | galera | 25.3.31-1.module+el8.3.0+7885+7a81225f |
| Oracle Linux 8 | mariadb | 3:10.3.27-3.module+el8.3.0+7885+7a81225f |
| Oracle Linux 8 | mariadb-backup | 3:10.3.27-3.module+el8.3.0+7885+7a81225f |
| Oracle Linux 8 | mariadb-common | 3:10.3.27-3.module+el8.3.0+7885+7a81225f |
| Oracle Linux 8 | mariadb-devel | 3:10.3.27-3.module+el8.3.0+7885+7a81225f |
| Oracle Linux 8 | mariadb-embedded | 3:10.3.27-3.module+el8.3.0+7885+7a81225f |
| Oracle Linux 8 | mariadb-embedded-devel | 3:10.3.27-3.module+el8.3.0+7885+7a81225f |
| Oracle Linux 8 | mariadb-errmsg | 3:10.3.27-3.module+el8.3.0+7885+7a81225f |
| Oracle Linux 8 | mariadb-gssapi-server | 3:10.3.27-3.module+el8.3.0+7885+7a81225f |
| Oracle Linux 8 | mariadb-oqgraph-engine | 3:10.3.27-3.module+el8.3.0+7885+7a81225f |
| Oracle Linux 8 | mariadb-server | 3:10.3.27-3.module+el8.3.0+7885+7a81225f |
| Oracle Linux 8 | mariadb-server-galera | 3:10.3.27-3.module+el8.3.0+7885+7a81225f |
| Oracle Linux 8 | mariadb-server-utils | 3:10.3.27-3.module+el8.3.0+7885+7a81225f |
| Oracle Linux 8 | mariadb-test | 3:10.3.27-3.module+el8.3.0+7885+7a81225f |
| rocky 8 | mariadb:10.3::Judy | 1.0.5-18.module+el8.4.0+427+adf35707 |
| root.io debian 11 | rootio-mariadb-10.5 | 1:10.5.6-1 |
| ubuntu 18.04 | mariadb-10.1 | 1:10.1.47-0ubuntu0.18.04.1 |
| ubuntu 18.04-ESM | mariadb-10.1 | 1:10.1.47-0ubuntu0.18.04.1 |
| ubuntu 20.04 | mariadb-10.3 | 1:10.3.25-0ubuntu0.20.04.1 |
| ubuntu 20.04-ESM | mariadb-10.3 | 1:10.3.25-0ubuntu0.20.04.1 |
Références
- https://access.redhat.com/security/cve/CVE-2020-15180
- https://bugzilla.redhat.com/show_bug.cgi?id=1764680
- https://bugzilla.redhat.com/show_bug.cgi?id=1764691
- https://bugzilla.redhat.com/show_bug.cgi?id=1798587
- https://bugzilla.redhat.com/show_bug.cgi?id=1830056
- https://bugzilla.redhat.com/show_bug.cgi?id=1830059
- https://bugzilla.redhat.com/show_bug.cgi?id=1830060
- https://bugzilla.redhat.com/show_bug.cgi?id=1830082
Les 49 références
- https://bugzilla.redhat.com/show_bug.cgi?id=1835849
- https://bugzilla.redhat.com/show_bug.cgi?id=1839827
- https://bugzilla.redhat.com/show_bug.cgi?id=1890738
- https://bugzilla.redhat.com/show_bug.cgi?id=1890743
- https://bugzilla.redhat.com/show_bug.cgi?id=1890747
- https://bugzilla.redhat.com/show_bug.cgi?id=1890756
- https://bugzilla.redhat.com/show_bug.cgi?id=1894919
- https://bugzilla.redhat.com/show_bug.cgi?id=1899009
- https://bugzilla.redhat.com/show_bug.cgi?id=1899017
- https://bugzilla.redhat.com/show_bug.cgi?id=1899021
- https://bugzilla.redhat.com/show_bug.cgi?id=1899082
- https://bugzilla.redhat.com/show_bug.cgi?id=1899086
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-2938
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-2974
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13249
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14765
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14776
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14789
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14812
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15180
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-2574
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-2752
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-2760
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-2780
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-2812
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-2814
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-2022
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-2144
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-2194
- https://errata.almalinux.org/8/ALSA-2020-5500.html
- https://errata.rockylinux.org/RLSA-2020:5500
- https://linux.oracle.com/cve/CVE-2020-15180.html
- https://linux.oracle.com/errata/ELSA-2020-5500.html
- https://lists.debian.org/debian-lts-announce/2020/10/msg00021.html
- https://mariadb.com/kb/en/security/
- https://nvd.nist.gov/vuln/detail/CVE-2020-15180
- https://security.gentoo.org/glsa/202011-14
- https://ubuntu.com/security/notices/USN-4603-1
- https://www.cve.org/CVERecord?id=CVE-2020-15180
- https://www.debian.org/security/2020/dsa-4776
- https://www.percona.com/blog/2020/10/30/cve-2020-15180-affects-percona-xtradb-cluster/