Security update for mariadb SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2020:0527-1 Final 1 1 2020-02-28T10:51:32Z current 2020-02-28T10:51:32Z 2020-02-28T10:51:32Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for mariadb This update for mariadb fixes the following issues: MariaDB was updated to version 10.0.40-3 (bsc#1162388). Security issues fixed: - CVE-2020-2574: Fixed a difficult to exploit vulnerability that allowed an attacker to crash the client (bsc#1162388). - CVE-2019-18901: Fixed an unsafe path handling behavior in mysql-systemd-helper (bsc#1160895). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). HPE-Helion-OpenStack-8-2020-527,SUSE-2020-527,SUSE-OpenStack-Cloud-8-2020-527,SUSE-OpenStack-Cloud-Crowbar-8-2020-527 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2020/suse-su-20200527-1/ Link for SUSE-SU-2020:0527-1 https://lists.suse.com/pipermail/sle-security-updates/2020-February/006549.html E-Mail link for SUSE-SU-2020:0527-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1077717 SUSE Bug 1077717 https://bugzilla.suse.com/1160895 SUSE Bug 1160895 https://bugzilla.suse.com/1160912 SUSE Bug 1160912 https://bugzilla.suse.com/1162388 SUSE Bug 1162388 https://www.suse.com/security/cve/CVE-2019-18901/ SUSE CVE CVE-2019-18901 page https://www.suse.com/security/cve/CVE-2020-2574/ SUSE CVE CVE-2020-2574 page HPE Helion OpenStack 8 SUSE OpenStack Cloud 8 SUSE OpenStack Cloud Crowbar 8 libmysqlclient18-10.0.40.3-29.38.1 libmysqlclient-devel-10.0.40.3-29.38.1 libmysqlclient18-32bit-10.0.40.3-29.38.1 libmysqlclient18-64bit-10.0.40.3-29.38.1 libmysqlclient_r18-10.0.40.3-29.38.1 libmysqlclient_r18-32bit-10.0.40.3-29.38.1 libmysqlclient_r18-64bit-10.0.40.3-29.38.1 libmysqld-devel-10.0.40.3-29.38.1 libmysqld18-10.0.40.3-29.38.1 mariadb-10.0.40.3-29.38.1 mariadb-bench-10.0.40.3-29.38.1 mariadb-client-10.0.40.3-29.38.1 mariadb-errormessages-10.0.40.3-29.38.1 mariadb-test-10.0.40.3-29.38.1 mariadb-tools-10.0.40.3-29.38.1 libmysqlclient18-10.0.40.3-29.38.1 as a component of HPE Helion OpenStack 8 libmysqlclient18-10.0.40.3-29.38.1 as a component of SUSE OpenStack Cloud 8 libmysqlclient18-10.0.40.3-29.38.1 as a component of SUSE OpenStack Cloud Crowbar 8 A UNIX Symbolic Link (Symlink) Following vulnerability in the mysql-systemd-helper of the mariadb packaging of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15 allows local attackers to change the permissions of arbitrary files to 0640. This issue affects: SUSE Linux Enterprise Server 12 mariadb versions prior to 10.2.31-3.25.1. SUSE Linux Enterprise Server 15 mariadb versions prior to 10.2.31-3.26.1. CVE-2019-18901 HPE Helion OpenStack 8:libmysqlclient18-10.0.40.3-29.38.1 SUSE OpenStack Cloud 8:libmysqlclient18-10.0.40.3-29.38.1 SUSE OpenStack Cloud Crowbar 8:libmysqlclient18-10.0.40.3-29.38.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20200527-1/ https://www.suse.com/security/cve/CVE-2019-18901.html CVE-2019-18901 https://bugzilla.suse.com/1160285 SUSE Bug 1160285 https://bugzilla.suse.com/1160895 SUSE Bug 1160895 Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are affected are 5.6.46 and prior, 5.7.28 and prior and 8.0.18 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Client. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Client. CVSS 3.0 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). CVE-2020-2574 HPE Helion OpenStack 8:libmysqlclient18-10.0.40.3-29.38.1 SUSE OpenStack Cloud 8:libmysqlclient18-10.0.40.3-29.38.1 SUSE OpenStack Cloud Crowbar 8:libmysqlclient18-10.0.40.3-29.38.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20200527-1/ https://www.suse.com/security/cve/CVE-2020-2574.html CVE-2020-2574 https://bugzilla.suse.com/1161085 SUSE Bug 1161085 https://bugzilla.suse.com/1162388 SUSE Bug 1162388