CVE-2020-14837

medium

Published 2021-09-21 · Modified 2021-09-21

💬 Discuss on Community ✚ Propose mitigation

CVSS v3

—

CVSS v4 NEW

—

not yet in upstream

VIR risk

5.5

Description

RHSA-2021:3590: mysql:8.0 security, bug fix, and enhancement update (Moderate)

Predictions

Exploit likelihood

20%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

Mitigation details

Source: Red Hat Errata — Red Hat Inc. · View original ↗ · Open-Errata-API

Description mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2020) CVSS v3: 4.9 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Errata / fixed releases ProductPackageAdvisoryReleased Red Hat Enterprise Linux 8mysql:8.0-8040020210824134700.522a0ee4RHSA-2021:35902021-09-21T00:00:00Z Red Hat Software Collections for Red Hat Enterprise Linux…

Description

mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2020)

CVSS v3: 4.9 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)

Errata / fixed releases

Product	Package	Advisory	Released
Red Hat Enterprise Linux 8	`mysql:8.0-8040020210824134700.522a0ee4`	RHSA-2021:3590	2021-09-21T00:00:00Z
Red Hat Software Collections for Red Hat Enterprise Linux 7	`rh-mysql80-mysql-0:8.0.26-1.el7`	RHSA-2021:3811	2021-10-12T00:00:00Z
Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS	`rh-mysql80-mysql-0:8.0.26-1.el7`	RHSA-2021:3811	2021-10-12T00:00:00Z

Package state

Product	Package	State
Red Hat Enterprise Linux 5	`mysql55-mysql`	Not affected
Red Hat Enterprise Linux 6	`mysql`	Not affected
Red Hat Enterprise Linux 7	`mariadb`	Not affected
Red Hat Enterprise Linux 8	`mariadb:10.3/mariadb`	Not affected
Red Hat OpenStack Platform 10 (Newton)	`mariadb-galera`	Not affected
Red Hat OpenStack Platform 13 (Queens)	`mariadb`	Not affected
Red Hat Software Collections	`rh-mariadb102-mariadb`	Not affected
Red Hat Software Collections	`rh-mariadb103-mariadb`	Not affected

Apply commands

bash fix

Apply RHSA-2021:3590 for Red Hat Enterprise Linux 8

yum update -y mysql:8
# or:
dnf upgrade -y mysql:8

Affected

Vendor	Product	Version
redhat	Red Hat Enterprise Linux 5	`Not affected`
redhat	Red Hat Enterprise Linux 6	`Not affected`
redhat	Red Hat Enterprise Linux 7	`Not affected`
redhat	Red Hat Enterprise Linux 8	`Not affected`
redhat	Red Hat OpenStack Platform 10 (Newton)	`Not affected`
redhat	Red Hat OpenStack Platform 13 (Queens)	`Not affected`
redhat	Red Hat Software Collections	`Not affected`
redhat	Red Hat Software Collections	`Not affected`

OS impact

AlmaLinux Fixed 1 release

Version	Status	Fixed in
8	Fixed	`mysql-test-8.0.26-1.module_el8.4.0+2532+b8928c02.x86_64.rpm`

Debian Fixed 1 release

Version	Status	Fixed in
sid	Fixed	`8.0.22-1`

Red Hat Fixed 1 release

Version	Status	Fixed in
8	Fixed	—

Rocky Linux Fixed 1 release

Version	Status	Fixed in
8	Fixed	—

References

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.