Security update for mariadb SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2019:1162-1 Final 1 1 2019-05-06T14:30:54Z current 2019-05-06T14:30:54Z 2019-05-06T14:30:54Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for mariadb This update for mariadb to version 10.2.22 fixes the following issues: Security issues fixed (bsc#1122198): - CVE-2019-2510: Fixed a vulnerability which can lead to MySQL compromise and lead to Denial of Service. - CVE-2019-2537: Fixed a vulnerability which can lead to MySQL compromise and lead to Denial of Service. Other issues fixed: - Fixed an issue where mysl_install_db fails due to incorrect basedir (bsc#1127027). - Fixed an issue where the lograte was not working (bsc#1112767). - Backport Information Schema CHECK_CONSTRAINTS Table. - Maximum value of table_definition_cache is now 2097152. - InnoDB ALTER TABLE fixes. - Galera crash recovery fixes. - Encryption fixes. - Remove xtrabackup dependency as MariaDB ships a build in mariabackup so xtrabackup is not needed (bsc#1122475). The complete changelog can be found at: https://mariadb.com/kb/en/library/mariadb-10222-changelog/ The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). HPE-Helion-OpenStack-8-2019-1162,SUSE-2019-1162,SUSE-OpenStack-Cloud-8-2019-1162,SUSE-OpenStack-Cloud-Crowbar-8-2019-1162 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2019/suse-su-20191162-1/ Link for SUSE-SU-2019:1162-1 https://lists.suse.com/pipermail/sle-security-updates/2019-May/005427.html E-Mail link for SUSE-SU-2019:1162-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1112767 SUSE Bug 1112767 https://bugzilla.suse.com/1122198 SUSE Bug 1122198 https://bugzilla.suse.com/1122475 SUSE Bug 1122475 https://bugzilla.suse.com/1127027 SUSE Bug 1127027 https://www.suse.com/security/cve/CVE-2019-2510/ SUSE CVE CVE-2019-2510 page https://www.suse.com/security/cve/CVE-2019-2537/ SUSE CVE CVE-2019-2537 page HPE Helion OpenStack 8 SUSE OpenStack Cloud 8 SUSE OpenStack Cloud Crowbar 8 mariadb-10.2.22-4.11.1 mariadb-client-10.2.22-4.11.1 mariadb-errormessages-10.2.22-4.11.1 mariadb-galera-10.2.22-4.11.1 mariadb-tools-10.2.22-4.11.1 libmysqld-devel-10.2.22-4.11.1 libmysqld19-10.2.22-4.11.1 mariadb-bench-10.2.22-4.11.1 mariadb-test-10.2.22-4.11.1 mariadb-10.2.22-4.11.1 as a component of HPE Helion OpenStack 8 mariadb-client-10.2.22-4.11.1 as a component of HPE Helion OpenStack 8 mariadb-errormessages-10.2.22-4.11.1 as a component of HPE Helion OpenStack 8 mariadb-galera-10.2.22-4.11.1 as a component of HPE Helion OpenStack 8 mariadb-tools-10.2.22-4.11.1 as a component of HPE Helion OpenStack 8 mariadb-10.2.22-4.11.1 as a component of SUSE OpenStack Cloud 8 mariadb-client-10.2.22-4.11.1 as a component of SUSE OpenStack Cloud 8 mariadb-errormessages-10.2.22-4.11.1 as a component of SUSE OpenStack Cloud 8 mariadb-galera-10.2.22-4.11.1 as a component of SUSE OpenStack Cloud 8 mariadb-tools-10.2.22-4.11.1 as a component of SUSE OpenStack Cloud 8 mariadb-10.2.22-4.11.1 as a component of SUSE OpenStack Cloud Crowbar 8 mariadb-client-10.2.22-4.11.1 as a component of SUSE OpenStack Cloud Crowbar 8 mariadb-errormessages-10.2.22-4.11.1 as a component of SUSE OpenStack Cloud Crowbar 8 mariadb-galera-10.2.22-4.11.1 as a component of SUSE OpenStack Cloud Crowbar 8 mariadb-tools-10.2.22-4.11.1 as a component of SUSE OpenStack Cloud Crowbar 8 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Supported versions that are affected are 5.7.24 and prior and 8.0.13 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2019-2510 HPE Helion OpenStack 8:mariadb-10.2.22-4.11.1 HPE Helion OpenStack 8:mariadb-client-10.2.22-4.11.1 HPE Helion OpenStack 8:mariadb-errormessages-10.2.22-4.11.1 HPE Helion OpenStack 8:mariadb-galera-10.2.22-4.11.1 HPE Helion OpenStack 8:mariadb-tools-10.2.22-4.11.1 SUSE OpenStack Cloud 8:mariadb-10.2.22-4.11.1 SUSE OpenStack Cloud 8:mariadb-client-10.2.22-4.11.1 SUSE OpenStack Cloud 8:mariadb-errormessages-10.2.22-4.11.1 SUSE OpenStack Cloud 8:mariadb-galera-10.2.22-4.11.1 SUSE OpenStack Cloud 8:mariadb-tools-10.2.22-4.11.1 SUSE OpenStack Cloud Crowbar 8:mariadb-10.2.22-4.11.1 SUSE OpenStack Cloud Crowbar 8:mariadb-client-10.2.22-4.11.1 SUSE OpenStack Cloud Crowbar 8:mariadb-errormessages-10.2.22-4.11.1 SUSE OpenStack Cloud Crowbar 8:mariadb-galera-10.2.22-4.11.1 SUSE OpenStack Cloud Crowbar 8:mariadb-tools-10.2.22-4.11.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20191162-1/ https://www.suse.com/security/cve/CVE-2019-2510.html CVE-2019-2510 https://bugzilla.suse.com/1122198 SUSE Bug 1122198 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL). Supported versions that are affected are 5.6.42 and prior, 5.7.24 and prior and 8.0.13 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2019-2537 HPE Helion OpenStack 8:mariadb-10.2.22-4.11.1 HPE Helion OpenStack 8:mariadb-client-10.2.22-4.11.1 HPE Helion OpenStack 8:mariadb-errormessages-10.2.22-4.11.1 HPE Helion OpenStack 8:mariadb-galera-10.2.22-4.11.1 HPE Helion OpenStack 8:mariadb-tools-10.2.22-4.11.1 SUSE OpenStack Cloud 8:mariadb-10.2.22-4.11.1 SUSE OpenStack Cloud 8:mariadb-client-10.2.22-4.11.1 SUSE OpenStack Cloud 8:mariadb-errormessages-10.2.22-4.11.1 SUSE OpenStack Cloud 8:mariadb-galera-10.2.22-4.11.1 SUSE OpenStack Cloud 8:mariadb-tools-10.2.22-4.11.1 SUSE OpenStack Cloud Crowbar 8:mariadb-10.2.22-4.11.1 SUSE OpenStack Cloud Crowbar 8:mariadb-client-10.2.22-4.11.1 SUSE OpenStack Cloud Crowbar 8:mariadb-errormessages-10.2.22-4.11.1 SUSE OpenStack Cloud Crowbar 8:mariadb-galera-10.2.22-4.11.1 SUSE OpenStack Cloud Crowbar 8:mariadb-tools-10.2.22-4.11.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20191162-1/ https://www.suse.com/security/cve/CVE-2019-2537.html CVE-2019-2537 https://bugzilla.suse.com/1122198 SUSE Bug 1122198 https://bugzilla.suse.com/1136037 SUSE Bug 1136037