Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2019-2800: MySQL Server 8.0.16 and earlier can be crashed or tampered

CVE-2019-2800 · published 7 years ago

Summary

Versions of MySQL Server up to 8.0.16 allow a low‑privilege user on the network to make the database stop working or change some data. This can cause service interruptions and unauthorized data changes. Upgrade to a newer MySQL version or apply the vendor's patch to stop the risk.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
oracle	mysql	>= 8.0.0, <= 8.0.16 `cpe:2.3:a:oracle:mysql::::::::`
redhat	software_collections	1.0 `cpe:2.3:a:redhat:software_collections:1.0:::::::*`
redhat	enterprise_linux	8.0 `cpe:2.3:o:redhat:enterprise_linux:8.0:::::::*`
redhat	enterprise_linux_eus	8.1 8.2 8.4 8.6 `cpe:2.3:o:redhat:enterprise_linux_eus:8.1:::::::*`
redhat	enterprise_linux_server_aus	8.2 8.4 8.6 `cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:::::::*`
redhat	enterprise_linux_server_tus	8.2 8.4 8.6 `cpe:2.3:o:redhat:enterprise_linux_server_tus:8.2:::::::*`

Original advisory text

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication). Supported versions that are affected are 8.0.16 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.0 Base Score 7.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H).

References

http://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html Patch Vendor Advisory
https://access.redhat.com/errata/RHSA-2019:2484 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2511 Third Party Advisory
https://support.f5.com/csp/article/K04831884 Third Party Advisory
https://support.f5.com/csp/article/K04831884?utm_source=f5support&amp%3Butm_medi...

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

7.1 High

Exploitation

2% chance of attack within 30 days

Timeline

Published23 Jul 2019

Updated29 Oct 2026

First seen29 Sep 2026

Sources

CVE-2019-2800 · NVD

Track software like this

Free during beta