Vulnerability of Oracle MySQL: vulnerabilities of April 2020

Synthesis of the vulnerability

Several vulnerabilities were announced in Oracle products.

Vulnerable software: Debian, Fedora, IBM API Connect, MariaDB ~ precise, MySQL Community, MySQL Enterprise, SnapCenter Backup Management, openSUSE Leap, Solaris, Percona Server, RHEL, Slackware, SUSE Linux Enterprise Desktop, SLES, Ubuntu.

Severity of this announce: 3/4.

Number of vulnerabilities in this bulletin: 38.

Creation date: 14/04/2020.

Références of this computer vulnerability: 6255684, 6324761, CERTFR-2020-AVI-218, cpuapr2020, CVE-2020-2752, CVE-2020-2759, CVE-2020-2760, CVE-2020-2761, CVE-2020-2762, CVE-2020-2763, CVE-2020-2765, CVE-2020-2768, CVE-2020-2770, CVE-2020-2774, CVE-2020-2779, CVE-2020-2780, CVE-2020-2790, CVE-2020-2804, CVE-2020-2806, CVE-2020-2812, CVE-2020-2814, CVE-2020-2853, CVE-2020-2875, CVE-2020-2892, CVE-2020-2893, CVE-2020-2895, CVE-2020-2896, CVE-2020-2897, CVE-2020-2898, CVE-2020-2901, CVE-2020-2903, CVE-2020-2904, CVE-2020-2921, CVE-2020-2922, CVE-2020-2923, CVE-2020-2924, CVE-2020-2925, CVE-2020-2926, CVE-2020-2928, CVE-2020-2930, CVE-2020-2933, CVE-2020-2934, DLA-2245-1, DSA-4703-1, FEDORA-2020-136dc82437, FEDORA-2020-20ac7c92a1, FEDORA-2020-261c9ddd7c, FEDORA-2020-35f52d9370, FEDORA-2020-747ec39700, FEDORA-2020-ac2d47d89a, NTAP-20200416-0003, openSUSE-SU-2020:0870-1, RHSA-2020:3518-01, RHSA-2020:3732-01, RHSA-2020:3755-01, RHSA-2020:3757-01, RHSA-2020:4026-01, RHSA-2020:4174-01, RHSA-2020:5246-01, RHSA-2020:5500-01, RHSA-2020:5503-01, RHSA-2020:5654-01, RHSA-2020:5655-01, RHSA-2020:5660-01, RHSA-2020:5662-01, RHSA-2020:5663-01, RHSA-2020:5665-01, SSA:2020-133-01, SUSE-SU-2020:1710-1, SUSE-SU-2020:1711-1, SUSE-SU-2020:1798-1, USN-4350-1, USN-4603-1, VIGILANCE-VUL-32029.

Description of the vulnerability

Several vulnerabilities were announced in Oracle products.
Full bulletin, software filtering, emails, fixes, ... (Request your free trial)

This weakness announce impacts software or systems such as Debian, Fedora, IBM API Connect, MariaDB ~ precise, MySQL Community, MySQL Enterprise, SnapCenter Backup Management, openSUSE Leap, Solaris, Percona Server, RHEL, Slackware, SUSE Linux Enterprise Desktop, SLES, Ubuntu.

Our Vigil@nce team determined that the severity of this vulnerability alert is important.

The trust level is of type confirmed by the editor, with an origin of intranet client.

This bulletin is about 38 vulnerabilities.

An attacker with a expert ability can exploit this computer threat announce.

Solutions for this threat

Oracle MySQL: version 8.0.20.
The version 8.0.20 is fixed:
  https://support.oracle.com/rs?type=doc&id=2648128.1
  https://www.mysql.com/fr/downloads/
  https://dev.mysql.com/downloads/mysql/

Oracle MySQL: version 5.7.30.
The version 5.7.30 is fixed:
  https://support.oracle.com/rs?type=doc&id=2648128.1
  https://www.mysql.com/fr/downloads/
  https://dev.mysql.com/downloads/mysql/

Oracle MySQL: version 5.6.48.
The version 5.6.48 is fixed:
  https://support.oracle.com/rs?type=doc&id=2648128.1
  https://www.mysql.com/fr/downloads/
  https://dev.mysql.com/downloads/mysql/

Debian 8: new mysql-connector-java packages.
New packages are available:
Debian 8: mysql-connector-java 5.1.49-0+deb8u1

Debian 9: new mysql-connector-java packages.
New packages are available:
Debian 9: mysql-connector-java 5.1.49-0+deb9u1

Fedora 30-32: new community-mysql packages.
New packages are available:
  Fedora 30: community-mysql 8.0.20-1.fc30
  Fedora 31: community-mysql 8.0.20-1.fc31
  Fedora 32: community-mysql 8.0.20-1.fc32

Fedora 31: new galera packages.
New packages are available:
Fedora 31: galera 25.3.31-1.fc31

Fedora 31: new mariadb-connector-c packages.
New packages are available:
Fedora 31: mariadb-connector-c 3.1.11-1.fc31

Fedora 31: new mariadb packages.
New packages are available:
Fedora 31: mariadb 10.3.26-1.fc31

Fedora 32: new galera packages.
New packages are available:
Fedora 32: galera 26.4.4-2.fc32

Fedora 32: new mariadb-connector-c packages.
New packages are available:
Fedora 32: mariadb-connector-c 3.1.8-1.fc32

Fedora 32: new mysql-connector-java packages.
New packages are available:
Fedora 32: mysql-connector-java 8.0.21-1.fc32

IBM API Connect: fixed versions for MySQL (03/09/2020).
Fixed versions are indicated in information sources.

IBM API Connect: fixed versions for MySQL (04/08/2020).
Fixed versions are indicated in information sources.

MariaDB: version 10.1.45.
The version 10.1.45 is fixed:
https://mariadb.com/downloads/

MariaDB: version 10.2.32.
The version 10.2.32 is fixed:
https://mariadb.com/downloads/

MariaDB: version 10.3.23.
The version 10.3.23 is fixed:
https://mariadb.com/downloads/

MariaDB: version 10.4.13.
The version 10.4.13 is fixed:
https://mariadb.com/downloads/

MariaDB: version 5.5.68.
The version 5.5.68 is fixed:
https://mariadb.com/downloads/

openSUSE Leap 15.1: new mariadb packages.
New packages are available:
openSUSE Leap 15.1: mariadb 10.2.32-lp151.2.15.1

Oracle Solaris: patch for third party software of July 2020 v2.
A patch is available:
https://support.oracle.com/rs?type=doc&id=1448883.1

Percona Server: version 5.6.48-88.0.
The version 5.6.48-88.0 is fixed.

Percona XtraDB Cluster: version 5.6.48-28.40.
The version 5.6.48-28.40 is fixed:
https://www.percona.com/

RHEL 6, 7: new rh-mariadb102-mariadb packages.
New packages are available:
RHEL 6.0-6.10: rh-mariadb102-mariadb 10.2.33-1.el6
RHEL 7.0-7.9: rh-mariadb102-mariadb 10.2.33-1.el7

RHEL 7.8: new mariadb packages.
New packages are available:
RHEL 7.0-7.8: mariadb 5.5.68-1.el7

RHEL 7: new rh-mariadb103 packages.
New packages are available:
RHEL 7.0-7.9: rh-mariadb103-galera 25.3.31-1.el7, rh-mariadb103-mariadb 10.3.27-1.el7

RHEL 7: new rh-mysql80-mysql packages.
New packages are available:
RHEL 7.0-7.8: rh-mysql80-mysql 8.0.21-1.el7

RHEL 8.0-8.1: new mysql-8.0 module.
The following module is updated:
RHEL 8.0 Module: mysql:8.0
RHEL 8.1 Module: mysql:8.0

RHEL 8.0: new mariadb-10.3 module.
The following module is updated:
RHEL 8.0 Module: mariadb:10.3

RHEL 8.0: new mariadb-connector-c packages.
New packages are available:
RHEL 8.0: mariadb-connector-c 3.1.11-2.el8_0

RHEL 8.0: new mysql-8.0 module.
The following module is updated:
RHEL 8.0 Module: mysql:8.0

RHEL 8.1: new mariadb-10.3 module.
The following module is updated:
RHEL 8.1 Module: mariadb:10.3

RHEL 8.1: new mariadb-connector-c packages.
New packages are available:
RHEL 8.1: mariadb-connector-c 3.1.11-2.el8_1

RHEL 8.2: new mariadb-10.3 module.
The following module is updated:
RHEL 8.2 Module: mariadb:10.3

RHEL 8.2: new mariadb-connector-c packages.
New packages are available:
RHEL 8.2: mariadb-connector-c 3.1.11-2.el8_2

RHEL 8.3: new mariadb-connector-c packages.
New packages are available:
RHEL 8.3: mariadb-connector-c 3.1.11-2.el8_3

RHEL 8: new mariadb-10.3 module.
The following module is updated:
RHEL 8 Module: mariadb:10.3

Slackware: new mariadb packages.
New packages are available:
Slackware 14.1: mariadb 5.5.68-*-1_slack14.1

SnapCenter: solution for MySQL.
The solution is indicated in information sources.

SUSE LE 12 SP4-5: new mariadb-100 packages.
New packages are available:
SUSE LE 12 SP4: mariadb-100 10.0.40.4-2.20.1
SUSE LE 12 SP5: mariadb-100 10.0.40.4-2.20.1

SUSE LE 12 SP4-5: new mariadb packages.
New packages are available:
SUSE LE 12 SP4: mariadb 10.2.32-3.28.2
SUSE LE 12 SP5: mariadb 10.2.32-3.28.2

SUSE LE 15 SP1: new mariadb packages.
New packages are available:
SUSE LE 15 SP1: mariadb 10.2.32-3.29.2

Ubuntu: new mariadb-server packages.
New packages are available:
Ubuntu 20.04 LTS: mariadb-server 1:10.3.25-0ubuntu0.20.04.1
Ubuntu 18.04 LTS: mariadb-server 1:10.1.47-0ubuntu0.18.04.1

Ubuntu: new mysql-server packages.
New packages are available:
  Ubuntu 20.04 LTS: mysql-server-8.0 8.0.20-0ubuntu0.20.04.1
  Ubuntu 19.10: mysql-server-8.0 8.0.20-0ubuntu0.19.10.1
  Ubuntu 18.04 LTS: mysql-server-5.7 5.7.30-0ubuntu0.18.04.1
  Ubuntu 16.04 LTS: mysql-server-5.7 5.7.30-0ubuntu0.16.04.1

VMware Tanzu Application Service: fixed versions for MySQL.
Fixed versions are indicated in information sources.

Wind River Linux: version 10.18.44.18.
The version 10.18.44.18 is fixed:
https://support2.windriver.com/

Wind River Linux: version 10.19.45.8.
The version 10.19.45.8 is fixed.
Full bulletin, software filtering, emails, fixes, ... (Request your free trial)

Computer vulnerabilities tracking service

Vigil@nce provides a networks vulnerabilities database. The Vigil@nce security watch publishes vulnerability bulletins about threats impacting the information system.