CVE-2016-6225

Опубликовано: 23 мар. 2017

Источник: nvd

CVSS3: 5.9

CVSS2: 4.3

EPSS Низкий

Описание

xbcrypt in Percona XtraBackup before 2.3.6 and 2.4.x before 2.4.5 does not properly set the initialization vector (IV) for encryption, which makes it easier for context-dependent attackers to obtain sensitive information from encrypted backup files via a Chosen-Plaintext attack. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-6394.

Ссылки

http://lists.opensuse.org/opensuse-updates/2017-01/msg00125.html
Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2017-01/msg00126.html
Third Party Advisory
https://bugs.launchpad.net/percona-xtrabackup/+bug/1643949
Issue Tracking
Patch
Third Party Advisory
https://github.com/percona/percona-xtrabackup/pull/266
Issue Tracking
Patch
Third Party Advisory
https://github.com/percona/percona-xtrabackup/pull/267
Issue Tracking
Patch
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BAHI6ETS22FJCMLW7A6SICFKQXF5G2VI/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBVCP6KLFVGG6HSGLHLTMZRD6C4IJSZP/
https://www.percona.com/blog/2017/01/12/cve-2016-6225-percona-xtrabackup-encryption-iv-not-set-properly/
Vendor Advisory
http://lists.opensuse.org/opensuse-updates/2017-01/msg00125.html
Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2017-01/msg00126.html
Third Party Advisory
https://bugs.launchpad.net/percona-xtrabackup/+bug/1643949
Issue Tracking
Patch
Third Party Advisory
https://github.com/percona/percona-xtrabackup/pull/266
Issue Tracking
Patch
Third Party Advisory
https://github.com/percona/percona-xtrabackup/pull/267
Issue Tracking
Patch
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BAHI6ETS22FJCMLW7A6SICFKQXF5G2VI/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBVCP6KLFVGG6HSGLHLTMZRD6C4IJSZP/
https://www.percona.com/blog/2017/01/12/cve-2016-6225-percona-xtrabackup-encryption-iv-not-set-properly/
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:percona:xtrabackup:*:*:*:*:*:*:*:*

Версия до 2.3.5 (включая)

cpe:2.3:a:percona:xtrabackup:2.4.0:rc1:*:*:*:*:*:*

cpe:2.3:a:percona:xtrabackup:2.4.1:*:*:*:*:*:*:*

cpe:2.3:a:percona:xtrabackup:2.4.2:*:*:*:*:*:*:*

cpe:2.3:a:percona:xtrabackup:2.4.3:*:*:*:*:*:*:*

cpe:2.3:a:percona:xtrabackup:2.4.4:*:*:*:*:*:*:*

Конфигурация 2

Одно из

cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*

cpe:2.3:o:opensuse:leap:42.2:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:o:fedoraproject:fedora:24:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:25:*:*:*:*:*:*:*

EPSS

Процентиль: 66%

0.00526

Низкий

5.9 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-326

Связанные уязвимости

CVE-2016-6225

CVSS3: 5.9

ubuntu

почти 9 лет назад

CVE-2016-6225

CVSS3: 5.9

debian

почти 9 лет назад

xbcrypt in Percona XtraBackup before 2.3.6 and 2.4.x before 2.4.5 does ...

openSUSE-SU-2017:0251-1

suse-cvrf

около 9 лет назад

Security update for xtrabackup

openSUSE-SU-2017:0250-1

suse-cvrf

около 9 лет назад

Security update for xtrabackup

GHSA-qgjv-rwc2-2rr2

CVSS3: 5.9

github

больше 3 лет назад

EPSS

Процентиль: 66%

0.00526

Низкий

5.9 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-326