Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.0

Azure libdb versions before 5.3.28-7 can be taken over

published 6 years ago
Summary

The libdb component used in Azure can be exploited by someone who already has access to the system and can convince another user to interact. This could let the attacker gain full control of the data store. Update libdb to the latest version or apply the vendor’s patch to stop the risk.

What to do
  • Update azure libdb to version 5.3.28-7.
Affected software
Ecosystem VendorProductAffected versions
Azure Linux:3 azure libdb < 5.3.28-7
Fix: upgrade to 5.3.28-7
Original advisory text
CVE-2020-2981 affecting package libdb for versions less than 5.3.28-7
Vulnerability in the Data Store component of Oracle Berkeley DB. The supported version that is affected is Prior to 18.1.40. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Data Store executes to compromise Data Store. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Data Store. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
7.0 High
Timeline
Published15 Jul 2020
Updated23 Sep 2026
First seen23 Sep 2026
Sources
AZL-34928 · OSV
Track software like this
Free during beta