Bug 699876 – <dev-db/mysql-{5.7.29,8.0.19}: multiple vulnerabilities (CVE-2019-{2938,2974})

• Product: Gentoo Security
• Status: RESOLVED FIXED

[Description GLSAMaker/CVETool Bot 2019-11-11 19:09:01 UTC]

CVE-2019-2974 (https://nvd.nist.gov/vuln/detail/CVE-2019-2974):
  Vulnerability in the MySQL Server product of Oracle MySQL (component:
  Server: Optimizer). Supported versions that are affected are 5.6.45 and
  prior, 5.7.27 and prior and 8.0.17 and prior. Easily exploitable
  vulnerability allows low privileged attacker with network access via
  multiple protocols to compromise MySQL Server. Successful attacks of this
  vulnerability can result in unauthorized ability to cause a hang or
  frequently repeatable crash (complete DOS) of MySQL Server.

CVE-2019-2938 (https://nvd.nist.gov/vuln/detail/CVE-2019-2938):
  Vulnerability in the MySQL Server product of Oracle MySQL (component:
  InnoDB). Supported versions that are affected are 5.7.27 and prior and
  8.0.17 and prior. Difficult to exploit vulnerability allows high privileged
  attacker with network access via multiple protocols to compromise MySQL
  Server. Successful attacks of this vulnerability can result in unauthorized
  ability to cause a hang or frequently repeatable crash (complete DOS) of
  MySQL Server.

[Comment 1 Sam James 2020-03-19 20:59:20 UTC]

@maintainer(s), please cleanup

[Comment 2 Sam James 2020-03-19 21:05:12 UTC]

(In reply to sam_c (Security Padawan) from comment #1)
> @maintainer(s), please cleanup

sorry, no, please see bug 709624. waiting on ia64, ppc, arm64.

[Comment 3 NATTkA bot 2020-04-12 19:29:06 UTC]

Resetting sanity check; package list is empty or all packages are done.

[Comment 4 Thomas Deutschmann (RETIRED) 2021-05-24 18:01:52 UTC]

New GLSA request filed.

[Comment 5 GLSAMaker/CVETool Bot 2021-05-26 09:52:15 UTC]

This issue was resolved and addressed in
 GLSA 202105-27 at https://security.gentoo.org/glsa/202105-27
by GLSA coordinator Thomas Deutschmann (whissi).