CVE-2020-2896: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema). Supported versions that are affected are 8.0.19 and prior. Easily exploitable vulnerability allows...

Summary

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema). Supported versions that are affected are 8.0.19 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Succes...

What to do

Update oracle mysql to version 8.0.19 or later.

Affected software

Vendor	Product	Affected versions
oracle	mysql	>= 8.0.0, < 8.0.19 `cpe:2.3:a:oracle:mysql::::::::`
fedoraproject	fedora	30 31 32 `cpe:2.3:o:fedoraproject:fedora:30:::::::*`
canonical	ubuntu_linux	16.04 18.04 19.10 20.04 `cpe:2.3:o:canonical:ubuntu_linux:16.04::::esm:::`
netapp	active_iq_unified_manager	All versions `cpe:2.3:a:netapp:active_iq_unified_manager:-:::::vmware_vsphere::`
netapp	oncommand_insight	All versions `cpe:2.3:a:netapp:oncommand_insight:-:::::::*`
netapp	oncommand_workflow_automation	All versions `cpe:2.3:a:netapp:oncommand_workflow_automation:-:::::::*`
netapp	snapcenter	All versions `cpe:2.3:a:netapp:snapcenter:-:::::::*`

Original advisory text

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema). Supported versions that are affected are 8.0.19 and prior. Easily exploitable vulnerability allows...

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema). Supported versions that are affected are 8.0.19 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

References

https://usn.ubuntu.com/4350-1/ Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...
https://security.gentoo.org/glsa/202105-27 Third Party Advisory
https://security.netapp.com/advisory/ntap-20200416-0003/ Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2020.html Vendor Advisory