kritik
CVE-2020-15180
mariadb: Insufficient SST method name check leading to code injection in mysql-wsrep
En geç 24 Eki 2026, 07:11 UTC tarihinden beri Trivy database'indeO derlemeden önce ne zaman girdiği kayıtlı değil.
Kaynağa göre önem derecesi
NVD9.0CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Red Hat9.0CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Bitnami9.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD, Bitnami. Daha düşük diyenler: Red Hat (yüksek), AlmaLinux (yüksek), Oracle (yüksek), Rocky Linux (yüksek), Ubuntu (orta).
Açıklama
A flaw was found in the mysql-wsrep component of mariadb. Lack of input sanitization in `wsrep_sst_method` allows for command injection that can be exploited by a remote attacker to execute arbitrary commands on galera cluster nodes. This threatens the system's confidentiality, integrity, and availability. This flaw affects mariadb versions before 10.1.47, before 10.2.34, before 10.3.25, before 10.4.15 and before 10.5.6.
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | mariadb, mariadb-min, mysql-client | 10.1.47, 10.2.34, 10.3.25, 10.4.15, 10.5.6 |
| alma 8 | mariadb:10.5::Judy | 1.0.5-18.module_el8.5.0+2632+14ced695 |
| alpine 3.10 | mariadb | 10.3.25-r0 |
| alpine 3.11 | mariadb | 10.4.15-r0 |
| alpine 3.12 | mariadb | 10.4.15-r0 |
| alpine 3.13 | mariadb | 10.5.6-r0 |
| alpine 3.14 | mariadb | 10.5.6-r0 |
| alpine 3.15 | mariadb | 10.5.6-r0 |
| alpine 3.16 | mariadb | 10.5.6-r0 |
| alpine 3.17 | mariadb | 10.5.6-r0 |
| alpine 3.18 | mariadb | 10.5.6-r0 |
| alpine 3.19 | mariadb | 10.5.6-r0 |
29 kaynaktaki 47 kaydın hepsini göster
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | mariadb | 10.1.47, 10.2.34, 10.3.25, 10.4.15, 10.5.6 |
| bitnami::Bitnami Vulnerability Database | mariadb-min | 10.1.47, 10.2.34, 10.3.25, 10.4.15, 10.5.6 |
| bitnami::Bitnami Vulnerability Database | mysql-client | 10.1.47, 10.2.34, 10.3.25, 10.4.15, 10.5.6 |
| alma 8 | mariadb:10.5::Judy | 1.0.5-18.module_el8.5.0+2632+14ced695 |
| alpine 3.10 | mariadb | 10.3.25-r0 |
| alpine 3.11 | mariadb | 10.4.15-r0 |
| alpine 3.12 | mariadb | 10.4.15-r0 |
| alpine 3.13 | mariadb | 10.5.6-r0 |
| alpine 3.14 | mariadb | 10.5.6-r0 |
| alpine 3.15 | mariadb | 10.5.6-r0 |
| alpine 3.16 | mariadb | 10.5.6-r0 |
| alpine 3.17 | mariadb | 10.5.6-r0 |
| alpine 3.18 | mariadb | 10.5.6-r0 |
| alpine 3.19 | mariadb | 10.5.6-r0 |
| alpine 3.20 | mariadb | 10.5.6-r0 |
| alpine 3.21 | mariadb | 10.5.6-r0 |
| alpine 3.22 | mariadb | 10.5.6-r0 |
| alpine 3.23 | mariadb | 10.5.6-r0 |
| alpine 3.24 | mariadb | 10.5.6-r0 |
| alpine 3.9 | mariadb | 10.3.25-r0 |
| alpine edge | mariadb | 10.5.6-r0 |
| debian 10 | mariadb-10.3 | 1:10.3.25-0+deb10u1 |
| debian 11 | mariadb-10.5 | 1:10.5.6-1 |
| debian 9 | mariadb-10.1 | 10.1.47-0+deb9u1 |
| Oracle Linux 8 | Judy | 1.0.5-18.module+el8.1.0+5402+691bd77e |
| Oracle Linux 8 | Judy-devel | 1.0.5-18.module+el8.1.0+5402+691bd77e |
| Oracle Linux 8 | asio-devel | 1.10.8-7.module+el8.1.0+5402+691bd77e |
| Oracle Linux 8 | galera | 25.3.31-1.module+el8.3.0+7885+7a81225f |
| Oracle Linux 8 | mariadb | 3:10.3.27-3.module+el8.3.0+7885+7a81225f |
| Oracle Linux 8 | mariadb-backup | 3:10.3.27-3.module+el8.3.0+7885+7a81225f |
| Oracle Linux 8 | mariadb-common | 3:10.3.27-3.module+el8.3.0+7885+7a81225f |
| Oracle Linux 8 | mariadb-devel | 3:10.3.27-3.module+el8.3.0+7885+7a81225f |
| Oracle Linux 8 | mariadb-embedded | 3:10.3.27-3.module+el8.3.0+7885+7a81225f |
| Oracle Linux 8 | mariadb-embedded-devel | 3:10.3.27-3.module+el8.3.0+7885+7a81225f |
| Oracle Linux 8 | mariadb-errmsg | 3:10.3.27-3.module+el8.3.0+7885+7a81225f |
| Oracle Linux 8 | mariadb-gssapi-server | 3:10.3.27-3.module+el8.3.0+7885+7a81225f |
| Oracle Linux 8 | mariadb-oqgraph-engine | 3:10.3.27-3.module+el8.3.0+7885+7a81225f |
| Oracle Linux 8 | mariadb-server | 3:10.3.27-3.module+el8.3.0+7885+7a81225f |
| Oracle Linux 8 | mariadb-server-galera | 3:10.3.27-3.module+el8.3.0+7885+7a81225f |
| Oracle Linux 8 | mariadb-server-utils | 3:10.3.27-3.module+el8.3.0+7885+7a81225f |
| Oracle Linux 8 | mariadb-test | 3:10.3.27-3.module+el8.3.0+7885+7a81225f |
| rocky 8 | mariadb:10.3::Judy | 1.0.5-18.module+el8.4.0+427+adf35707 |
| root.io debian 11 | rootio-mariadb-10.5 | 1:10.5.6-1 |
| ubuntu 18.04 | mariadb-10.1 | 1:10.1.47-0ubuntu0.18.04.1 |
| ubuntu 18.04-ESM | mariadb-10.1 | 1:10.1.47-0ubuntu0.18.04.1 |
| ubuntu 20.04 | mariadb-10.3 | 1:10.3.25-0ubuntu0.20.04.1 |
| ubuntu 20.04-ESM | mariadb-10.3 | 1:10.3.25-0ubuntu0.20.04.1 |
Referanslar
- https://access.redhat.com/security/cve/CVE-2020-15180
- https://bugzilla.redhat.com/show_bug.cgi?id=1764680
- https://bugzilla.redhat.com/show_bug.cgi?id=1764691
- https://bugzilla.redhat.com/show_bug.cgi?id=1798587
- https://bugzilla.redhat.com/show_bug.cgi?id=1830056
- https://bugzilla.redhat.com/show_bug.cgi?id=1830059
- https://bugzilla.redhat.com/show_bug.cgi?id=1830060
- https://bugzilla.redhat.com/show_bug.cgi?id=1830082
49 referansın hepsi
- https://bugzilla.redhat.com/show_bug.cgi?id=1835849
- https://bugzilla.redhat.com/show_bug.cgi?id=1839827
- https://bugzilla.redhat.com/show_bug.cgi?id=1890738
- https://bugzilla.redhat.com/show_bug.cgi?id=1890743
- https://bugzilla.redhat.com/show_bug.cgi?id=1890747
- https://bugzilla.redhat.com/show_bug.cgi?id=1890756
- https://bugzilla.redhat.com/show_bug.cgi?id=1894919
- https://bugzilla.redhat.com/show_bug.cgi?id=1899009
- https://bugzilla.redhat.com/show_bug.cgi?id=1899017
- https://bugzilla.redhat.com/show_bug.cgi?id=1899021
- https://bugzilla.redhat.com/show_bug.cgi?id=1899082
- https://bugzilla.redhat.com/show_bug.cgi?id=1899086
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-2938
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-2974
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13249
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14765
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14776
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14789
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14812
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15180
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-2574
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-2752
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-2760
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-2780
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-2812
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-2814
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-2022
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-2144
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-2194
- https://errata.almalinux.org/8/ALSA-2020-5500.html
- https://errata.rockylinux.org/RLSA-2020:5500
- https://linux.oracle.com/cve/CVE-2020-15180.html
- https://linux.oracle.com/errata/ELSA-2020-5500.html
- https://lists.debian.org/debian-lts-announce/2020/10/msg00021.html
- https://mariadb.com/kb/en/security/
- https://nvd.nist.gov/vuln/detail/CVE-2020-15180
- https://security.gentoo.org/glsa/202011-14
- https://ubuntu.com/security/notices/USN-4603-1
- https://www.cve.org/CVERecord?id=CVE-2020-15180
- https://www.debian.org/security/2020/dsa-4776
- https://www.percona.com/blog/2020/10/30/cve-2020-15180-affects-percona-xtradb-cluster/