CVE编号
CVE-2020-13249利用情况
暂无补丁情况
官方补丁披露时间
2020-05-21漏洞描述
在3.1.8之前的MariaDB Connector/C中，libmariadb/mariadb_lib.c不能正确验证从服务器接收的OK包的内容。注意:虽然mariadb_lib.c最初基于MySQL的代码，但这个问题不会影响Oracle支持的任何MySQL组件。解决建议
目前厂商已发布升级补丁以修复漏洞，补丁获取链接：https://github.com/mariadb-corporation/mariadb-connector-c/commit/2759b87d72926b7c9b5426437a7c8dd15ff57945
参考链接 |
|
|---|---|
| http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00064.html | |
| http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00054.html | |
| https://github.com/mariadb-corporation/mariadb-connector-c/commit/2759b87d729... | |
| https://github.com/mariadb-corporation/mariadb-connector-c/compare/v3.1.7...v3.1.8 | |
| https://lists.fedoraproject.org/archives/list/[email protected]... | |
| https://lists.fedoraproject.org/archives/list/[email protected]... |
受影响软件情况
| # | 类型 | 厂商 | 产品 | 版本 | 影响面 | ||||
| 1 | |||||||||
|---|---|---|---|---|---|---|---|---|---|
| 运行在以下环境 | |||||||||
| 应用 | mariadb | connector/c | * |
Up to (excluding) 3.1.8 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | alibaba_cloud_linux_2.1903 | mariadb | * |
Up to (excluding) 3.1.11-2.1.al8 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_3.10 | mariadb | * |
Up to (excluding) 3.0.10-r1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_3.11 | mariadb | * |
Up to (excluding) 3.1.6-r1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_3.9 | mariadb | * |
Up to (excluding) 3.0.8-r1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | centos_8 | mariadb | * |
Up to (excluding) 3.1.11-2.el8_3 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | debian_10 | mariadb | * |
Up to (excluding) 1:10.3.23-0+deb10u1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | fedora_31 | mariadb | * |
Up to (excluding) 25.3.31-1.fc31 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | fedora_31_Modular | mariadb | * |
Up to (excluding) 10.3-3120201026103040.f636be4b |
|||||
| 运行在以下环境 | |||||||||
| 系统 | fedora_32 | mariadb | * |
Up to (excluding) 26.4.4-2.fc32 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | fedora_32_Modular | mariadb | * |
Up to (excluding) 10.3-3220201026103040.43bbeeef |
|||||
| 运行在以下环境 | |||||||||
| 系统 | opensuse_Leap_15.1 | mariadb | * |
Up to (excluding) 3.1.8-lp151.3.12.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | oracle_8 | mariadb | * |
Up to (excluding) 3.1.11-2.el8_3 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | redhat_8 | mariadb | * |
Up to (excluding) 3.1.11-2.el8_3 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | suse_12_SP4 | mariadb | * |
Up to (excluding) 3.1.8-2.15.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | suse_12_SP5 | mariadb | * |
Up to (excluding) 3.1.8-2.15.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | ubuntu_18.04 | mariadb | * |
Up to (excluding) 1:10.1.47-0ubuntu0.18.04.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | ubuntu_20.04 | mariadb | * |
Up to (excluding) 1:10.3.25-0ubuntu0.20.04.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | unionos_20 | mariadb | * |
Up to (excluding) 1:10.3.23-0+deb10u1 |
|||||
- 攻击路径 远程
- 攻击复杂度 复杂
- 权限要求 无需权限
- 影响范围 有限影响
- EXP成熟度 未验证
- 补丁情况 官方补丁
- 数据保密性 无影响
- 数据完整性 无影响
- 服务器危害 无影响
- 全网数量 100
还没有评论，来说两句吧...