exploitDog

CVE-2019-2503

Опубликовано: 16 янв. 2019

Источник: nvd

CVSS3: 6.4

CVSS2: 3.8

EPSS Низкий

Описание

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Connection Handling). Supported versions that are affected are 5.6.42 and prior, 5.7.24 and prior and 8.0.13 and prior. Difficult to exploit vulnerability allows low privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Server executes to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Server accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.4 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H).

Ссылки

http://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
Patch
Vendor Advisory
http://www.securityfocus.com/bid/106626
Third Party Advisory
VDB Entry
https://access.redhat.com/errata/RHSA-2019:1258
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2327
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2484
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2511
Third Party Advisory
https://security.netapp.com/advisory/ntap-20190118-0002/
Third Party Advisory
https://usn.ubuntu.com/3867-1/
Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
Patch
Vendor Advisory
http://www.securityfocus.com/bid/106626
Third Party Advisory
VDB Entry
https://access.redhat.com/errata/RHSA-2019:1258
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2327
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2484
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2511
Third Party Advisory
https://security.netapp.com/advisory/ntap-20190118-0002/
Third Party Advisory
https://usn.ubuntu.com/3867-1/
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:*

Версия от 5.6.0 (включая) до 5.6.42 (включая)

cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:*

Версия от 5.7.0 (включая) до 5.7.24 (включая)

cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:*

Версия от 8.0.0 (включая) до 8.0.13 (включая)

Конфигурация 2

Одно из

cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*

Версия от 5.5.0 (включая) до 5.5.62 (исключая)

cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*

Версия от 10.0.0 (включая) до 10.0.37 (исключая)

cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*

Версия от 10.1.0 (включая) до 10.1.36 (исключая)

cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*

Версия от 10.2.0 (включая) до 10.2.18 (исключая)

cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*

Версия от 10.3.0 (включая) до 10.3.10 (исключая)

Конфигурация 3

Одно из

cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:windows:*:*

Версия от 7.3 (включая)

cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:vmware_vsphere:*:*

Версия от 9.5 (включая)

cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*

cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*

cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*

Конфигурация 4

Одно из

cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*

Конфигурация 5

Одно из

cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_desktop:8.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_eus:8.1:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_eus:8.2:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_eus:8.4:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_eus:8.6:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server:8.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_aus:8.6:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_tus:8.2:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_tus:8.4:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_tus:8.6:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_workstation:8.0:*:*:*:*:*:*:*

EPSS

Процентиль: 41%

0.00184

Низкий

6.4 Medium

CVSS3

3.8 Low

CVSS2

Дефекты

NVD-CWE-noinfo

Связанные уязвимости

CVE-2019-2503

CVSS3: 6.4

ubuntu

больше 6 лет назад

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Connection Handling). Supported versions that are affected are 5.6.42 and prior, 5.7.24 and prior and 8.0.13 and prior. Difficult to exploit vulnerability allows low privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Server executes to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Server accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.4 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H).

CVE-2019-2503

CVSS3: 6.4

redhat

больше 6 лет назад

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Connection Handling). Supported versions that are affected are 5.6.42 and prior, 5.7.24 and prior and 8.0.13 and prior. Difficult to exploit vulnerability allows low privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Server executes to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Server accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.4 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H).

CVE-2019-2503

CVSS3: 6.4

debian

больше 6 лет назад

Vulnerability in the MySQL Server component of Oracle MySQL (subcompon ...

GHSA-px7j-2qhq-c538

CVSS3: 6.4

github

около 3 лет назад

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Connection Handling). Supported versions that are affected are 5.6.42 and prior, 5.7.24 and prior and 8.0.13 and prior. Difficult to exploit vulnerability allows low privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Server executes to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Server accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.4 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H).

BDU:2019-00591

CVSS3: 6.4

fstec

больше 6 лет назад

Уязвимость компонента Server: Connection Handling системы управления базами данных MySQL, позволяющая нарушителю вызвать отказ в обслуживании

EPSS

Процентиль: 41%

0.00184

Низкий

6.4 Medium

CVSS3

3.8 Low

CVSS2

Дефекты

NVD-CWE-noinfo

Уязвимость CVE-2019-2503