Security update for mariadb-100 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2020:1798-1 Final 1 1 2020-06-30T09:29:15Z current 2020-06-30T09:29:15Z 2020-06-30T09:29:15Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for mariadb-100 This update for mariadb-100 fixes the following issues: mariadb-100 was updated to version 10.0.44 (bsc#1171550) - CVE-2020-2752: Fixed an issue which could have resulted in unauthorized ability to cause denial of service. - CVE-2020-2812: Fixed an issue which could have resulted in unauthorized ability to cause denial of service. - Fixed some test failures The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2020-1798,SUSE-SLE-SDK-12-SP4-2020-1798,SUSE-SLE-SDK-12-SP5-2020-1798,SUSE-SLE-SERVER-12-SP4-2020-1798,SUSE-SLE-SERVER-12-SP5-2020-1798,SUSE-SLE-WE-12-SP4-2020-1798,SUSE-SLE-WE-12-SP5-2020-1798 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2020/suse-su-20201798-1/ Link for SUSE-SU-2020:1798-1 https://lists.suse.com/pipermail/sle-security-updates/2020-June/007053.html E-Mail link for SUSE-SU-2020:1798-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1171550 SUSE Bug 1171550 https://www.suse.com/security/cve/CVE-2020-2752/ SUSE CVE CVE-2020-2752 page https://www.suse.com/security/cve/CVE-2020-2812/ SUSE CVE CVE-2020-2812 page SUSE Linux Enterprise Server 12 SP4 SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Server for SAP Applications 12 SP4 SUSE Linux Enterprise Server for SAP Applications 12 SP5 SUSE Linux Enterprise Software Development Kit 12 SP4 SUSE Linux Enterprise Software Development Kit 12 SP5 SUSE Linux Enterprise Workstation Extension 12 SP4 SUSE Linux Enterprise Workstation Extension 12 SP5 libmysqlclient-devel-10.0.40.4-2.20.1 libmysqlclient18-10.0.40.4-2.20.1 libmysqlclient18-32bit-10.0.40.4-2.20.1 libmysqlclient18-64bit-10.0.40.4-2.20.1 libmysqlclient_r18-10.0.40.4-2.20.1 libmysqlclient_r18-32bit-10.0.40.4-2.20.1 libmysqlclient_r18-64bit-10.0.40.4-2.20.1 libmysqld-devel-10.0.40.4-2.20.1 libmysqld18-10.0.40.4-2.20.1 mariadb-100-10.0.40.4-2.20.1 mariadb-100-bench-10.0.40.4-2.20.1 mariadb-100-client-10.0.40.4-2.20.1 mariadb-100-errormessages-10.0.40.4-2.20.1 mariadb-100-test-10.0.40.4-2.20.1 mariadb-100-tools-10.0.40.4-2.20.1 libmysqlclient18-10.0.40.4-2.20.1 as a component of SUSE Linux Enterprise Server 12 SP4 libmysqlclient18-32bit-10.0.40.4-2.20.1 as a component of SUSE Linux Enterprise Server 12 SP4 mariadb-100-errormessages-10.0.40.4-2.20.1 as a component of SUSE Linux Enterprise Server 12 SP4 libmysqlclient18-10.0.40.4-2.20.1 as a component of SUSE Linux Enterprise Server 12 SP5 libmysqlclient18-32bit-10.0.40.4-2.20.1 as a component of SUSE Linux Enterprise Server 12 SP5 mariadb-100-errormessages-10.0.40.4-2.20.1 as a component of SUSE Linux Enterprise Server 12 SP5 libmysqlclient18-10.0.40.4-2.20.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 libmysqlclient18-32bit-10.0.40.4-2.20.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 mariadb-100-errormessages-10.0.40.4-2.20.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 libmysqlclient18-10.0.40.4-2.20.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 libmysqlclient18-32bit-10.0.40.4-2.20.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 mariadb-100-errormessages-10.0.40.4-2.20.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 libmysqlclient-devel-10.0.40.4-2.20.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP4 libmysqlclient_r18-10.0.40.4-2.20.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP4 libmysqld-devel-10.0.40.4-2.20.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP4 libmysqld18-10.0.40.4-2.20.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP4 libmysqlclient-devel-10.0.40.4-2.20.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 libmysqlclient_r18-10.0.40.4-2.20.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 libmysqld-devel-10.0.40.4-2.20.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 libmysqld18-10.0.40.4-2.20.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 libmysqlclient_r18-10.0.40.4-2.20.1 as a component of SUSE Linux Enterprise Workstation Extension 12 SP4 libmysqlclient_r18-32bit-10.0.40.4-2.20.1 as a component of SUSE Linux Enterprise Workstation Extension 12 SP4 libmysqlclient_r18-10.0.40.4-2.20.1 as a component of SUSE Linux Enterprise Workstation Extension 12 SP5 libmysqlclient_r18-32bit-10.0.40.4-2.20.1 as a component of SUSE Linux Enterprise Workstation Extension 12 SP5 Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are affected are 5.6.47 and prior, 5.7.27 and prior and 8.0.17 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Client. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Client. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H). CVE-2020-2752 SUSE Linux Enterprise Server 12 SP4:libmysqlclient18-10.0.40.4-2.20.1 SUSE Linux Enterprise Server 12 SP4:libmysqlclient18-32bit-10.0.40.4-2.20.1 SUSE Linux Enterprise Server 12 SP4:mariadb-100-errormessages-10.0.40.4-2.20.1 SUSE Linux Enterprise Server 12 SP5:libmysqlclient18-10.0.40.4-2.20.1 SUSE Linux Enterprise Server 12 SP5:libmysqlclient18-32bit-10.0.40.4-2.20.1 SUSE Linux Enterprise Server 12 SP5:mariadb-100-errormessages-10.0.40.4-2.20.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libmysqlclient18-10.0.40.4-2.20.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libmysqlclient18-32bit-10.0.40.4-2.20.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:mariadb-100-errormessages-10.0.40.4-2.20.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libmysqlclient18-10.0.40.4-2.20.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libmysqlclient18-32bit-10.0.40.4-2.20.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:mariadb-100-errormessages-10.0.40.4-2.20.1 SUSE Linux Enterprise Software Development Kit 12 SP4:libmysqlclient-devel-10.0.40.4-2.20.1 SUSE Linux Enterprise Software Development Kit 12 SP4:libmysqlclient_r18-10.0.40.4-2.20.1 SUSE Linux Enterprise Software Development Kit 12 SP4:libmysqld-devel-10.0.40.4-2.20.1 SUSE Linux Enterprise Software Development Kit 12 SP4:libmysqld18-10.0.40.4-2.20.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libmysqlclient-devel-10.0.40.4-2.20.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libmysqlclient_r18-10.0.40.4-2.20.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libmysqld-devel-10.0.40.4-2.20.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libmysqld18-10.0.40.4-2.20.1 SUSE Linux Enterprise Workstation Extension 12 SP4:libmysqlclient_r18-10.0.40.4-2.20.1 SUSE Linux Enterprise Workstation Extension 12 SP4:libmysqlclient_r18-32bit-10.0.40.4-2.20.1 SUSE Linux Enterprise Workstation Extension 12 SP5:libmysqlclient_r18-10.0.40.4-2.20.1 SUSE Linux Enterprise Workstation Extension 12 SP5:libmysqlclient_r18-32bit-10.0.40.4-2.20.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20201798-1/ https://www.suse.com/security/cve/CVE-2020-2752.html CVE-2020-2752 https://bugzilla.suse.com/1171550 SUSE Bug 1171550 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure). Supported versions that are affected are 5.6.47 and prior, 5.7.29 and prior and 8.0.19 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2020-2812 SUSE Linux Enterprise Server 12 SP4:libmysqlclient18-10.0.40.4-2.20.1 SUSE Linux Enterprise Server 12 SP4:libmysqlclient18-32bit-10.0.40.4-2.20.1 SUSE Linux Enterprise Server 12 SP4:mariadb-100-errormessages-10.0.40.4-2.20.1 SUSE Linux Enterprise Server 12 SP5:libmysqlclient18-10.0.40.4-2.20.1 SUSE Linux Enterprise Server 12 SP5:libmysqlclient18-32bit-10.0.40.4-2.20.1 SUSE Linux Enterprise Server 12 SP5:mariadb-100-errormessages-10.0.40.4-2.20.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libmysqlclient18-10.0.40.4-2.20.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libmysqlclient18-32bit-10.0.40.4-2.20.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:mariadb-100-errormessages-10.0.40.4-2.20.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libmysqlclient18-10.0.40.4-2.20.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libmysqlclient18-32bit-10.0.40.4-2.20.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:mariadb-100-errormessages-10.0.40.4-2.20.1 SUSE Linux Enterprise Software Development Kit 12 SP4:libmysqlclient-devel-10.0.40.4-2.20.1 SUSE Linux Enterprise Software Development Kit 12 SP4:libmysqlclient_r18-10.0.40.4-2.20.1 SUSE Linux Enterprise Software Development Kit 12 SP4:libmysqld-devel-10.0.40.4-2.20.1 SUSE Linux Enterprise Software Development Kit 12 SP4:libmysqld18-10.0.40.4-2.20.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libmysqlclient-devel-10.0.40.4-2.20.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libmysqlclient_r18-10.0.40.4-2.20.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libmysqld-devel-10.0.40.4-2.20.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libmysqld18-10.0.40.4-2.20.1 SUSE Linux Enterprise Workstation Extension 12 SP4:libmysqlclient_r18-10.0.40.4-2.20.1 SUSE Linux Enterprise Workstation Extension 12 SP4:libmysqlclient_r18-32bit-10.0.40.4-2.20.1 SUSE Linux Enterprise Workstation Extension 12 SP5:libmysqlclient_r18-10.0.40.4-2.20.1 SUSE Linux Enterprise Workstation Extension 12 SP5:libmysqlclient_r18-32bit-10.0.40.4-2.20.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20201798-1/ https://www.suse.com/security/cve/CVE-2020-2812.html CVE-2020-2812 https://bugzilla.suse.com/1171550 SUSE Bug 1171550