Bug 699874 – <dev-db/mariadb-{5.5.66,10.1.43,10.2.28,10.3.20,10.4.10}: multiple vulnerabilities (CVE-2019-{2938,2974})

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description GLSAMaker/CVETool Bot 2019-11-11 19:08:27 UTC]

CVE-2019-2974 (https://nvd.nist.gov/vuln/detail/CVE-2019-2974):
  Vulnerability in the MySQL Server product of Oracle MySQL (component:
  Server: Optimizer). Supported versions that are affected are 5.6.45 and
  prior, 5.7.27 and prior and 8.0.17 and prior. Easily exploitable
  vulnerability allows low privileged attacker with network access via
  multiple protocols to compromise MySQL Server. Successful attacks of this
  vulnerability can result in unauthorized ability to cause a hang or
  frequently repeatable crash (complete DOS) of MySQL Server.

CVE-2019-2938 (https://nvd.nist.gov/vuln/detail/CVE-2019-2938):
  Vulnerability in the MySQL Server product of Oracle MySQL (component:
  InnoDB). Supported versions that are affected are 5.7.27 and prior and
  8.0.17 and prior. Difficult to exploit vulnerability allows high privileged
  attacker with network access via multiple protocols to compromise MySQL
  Server. Successful attacks of this vulnerability can result in unauthorized
  ability to cause a hang or frequently repeatable crash (complete DOS) of
  MySQL Server.

[Comment 1 Brian Evans (RETIRED) 2019-11-12 00:45:58 UTC]

CVE-2019-2938 affected packages: <dev-db/mariadb-10.2.28 ; <dev-db/mariadb-10.3.19 ; <dev-db/mariadb-10.4.9

CVE-2019-2974 affected packages: <dev-db/mariadb-5.5.66 ; <dev-db/mariadb-10.1.42 ; <dev-db/mariadb-10.2.28 ; <dev-db/mariadb-10.3.19 ; <dev-db/mariadb-10.4.9

[Comment 2 Brian Evans (RETIRED) 2019-11-12 00:56:32 UTC]

Arches, please test and mark stable

[Comment 3 Agostino Sarubbo 2019-11-18 13:40:58 UTC]

amd64 stable

[Comment 4 Mikle Kolyada (RETIRED) 2019-11-22 09:41:45 UTC]

arm stable

[Comment 5 Thomas Deutschmann (RETIRED) 2019-11-26 01:00:28 UTC]

x86 stable

[Comment 6 Sergei Trofimovich (RETIRED) 2019-12-09 18:39:21 UTC]

ia64 stable

[Comment 7 Sam James 2020-07-11 00:13:23 UTC]

We'll stabilise in the newer bug: bug 722782.

[addCollapseLink(8, 1, 'Toggle comment display'); Comment 8 NATTkA bot 2020-07-11 00:17:15 UTC Comment hidden (obsolete)]

Resetting sanity check; keywords are not fully specified and arches are not CC-ed.

[addCollapseLink(9, 1, 'Toggle comment display'); Comment 9 NATTkA bot 2020-07-26 00:13:35 UTC Comment hidden (obsolete)]

Unable to check for sanity:

> no match for package: dev-db/mariadb-10.1.43

[Comment 10 NATTkA bot 2021-04-01 20:13:20 UTC]

Unable to check for sanity:

> no match for package: dev-db/mariadb-10.1.43

[Comment 11 John Helmert III 2021-09-25 13:55:03 UTC]

I guess this needs to be added to the GLSA for bug 722782?

[Comment 12 Larry the Git Cow 2024-05-08 08:40:29 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=b69f175bb86c550d8cad22e4c391edbf3ccd7c16

commit b69f175bb86c550d8cad22e4c391edbf3ccd7c16
Author:     GLSAMaker <[e-mail]>
AuthorDate: 2024-05-08 08:40:00 +0000
Commit:     Hans de Graaff <[e-mail]>
CommitDate: 2024-05-08 08:40:18 +0000

    [ GLSA 202405-25 ] MariaDB: Multiple Vulnerabilities
    
    Bug: https://bugs.gentoo.org/699874
    Bug: https://bugs.gentoo.org/822759
    Bug: https://bugs.gentoo.org/832490
    Bug: https://bugs.gentoo.org/838244
    Bug: https://bugs.gentoo.org/847526
    Bug: https://bugs.gentoo.org/856484
    Bug: https://bugs.gentoo.org/891781
    Signed-off-by: GLSAMaker <[e-mail]>
    Signed-off-by: Hans de Graaff <[e-mail]>

 glsa-202405-25.xml | 111 +++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 111 insertions(+)