CVE-2020-13249 - mariadb-connector-c: Improper validation of content in a OK packet received from server

Back Back to CVE browser

HIGH

mariadb-connector-c: Improper validation of content in a OK packet received from server

Published May 20, 2020

8.8

HIGH

CVSS 3.1

EPSS 2.40%

Description

libmariadb/mariadb_lib.c in MariaDB Connector/C before 3.1.8 does not properly validate the content of an OK packet received from a server. NOTE: although mariadb_lib.c was originally based on code shipped for MySQL, this issue does not affect any MySQL components supported by Oracle.

Affected products

Red Hat Enterprise Linux 8

mariadb-connector-c-0:3.1.11-2.el8_3

Fixed · RHSA-2020:5503
Red Hat Enterprise Linux 8

mariadb:10.3-8030020201203011231.229f0a1c

Fixed · RHSA-2020:5500
Red Hat Enterprise Linux 8.0 Update Services for SAP Solutions

mariadb-connector-c-0:3.1.11-2.el8_0

Fixed · RHSA-2020:5662
Red Hat Enterprise Linux 8.0 Update Services for SAP Solutions

mariadb:10.3-8000020201221114409.f8e95b4e

Fixed · RHSA-2020:5663
Red Hat Enterprise Linux 8.1 Extended Update Support

mariadb-connector-c-0:3.1.11-2.el8_1

Fixed · RHSA-2020:5660
Red Hat Enterprise Linux 8.1 Extended Update Support

mariadb:10.3-8010020201214133427.c27ad7f8

Fixed · RHSA-2020:5665
Red Hat Enterprise Linux 8.2 Extended Update Support

mariadb-connector-c-0:3.1.11-2.el8_2

Fixed · RHSA-2020:5655
Red Hat Enterprise Linux 8.2 Extended Update Support

mariadb:10.3-8020020201214133105.4cda2c84

Fixed · RHSA-2020:5654
Red Hat Software Collections for Red Hat Enterprise Linux 6

rh-mariadb102-galera-0:25.3.29-1.el6

Fixed · RHSA-2020:4174
Red Hat Software Collections for Red Hat Enterprise Linux 6

rh-mariadb102-mariadb-1:10.2.33-1.el6

Fixed · RHSA-2020:4174
Red Hat Software Collections for Red Hat Enterprise Linux 7

rh-mariadb102-galera-0:25.3.29-1.el7

Fixed · RHSA-2020:4174
Red Hat Software Collections for Red Hat Enterprise Linux 7

rh-mariadb102-mariadb-1:10.2.33-1.el7

Fixed · RHSA-2020:4174
Red Hat Software Collections for Red Hat Enterprise Linux 7

rh-mariadb103-galera-0:25.3.31-1.el7

Fixed · RHSA-2020:5246
Red Hat Software Collections for Red Hat Enterprise Linux 7

rh-mariadb103-mariadb-3:10.3.27-1.el7

Fixed · RHSA-2020:5246
Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS

rh-mariadb102-galera-0:25.3.29-1.el7

Fixed · RHSA-2020:4174
Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS

rh-mariadb102-mariadb-1:10.2.33-1.el7

Fixed · RHSA-2020:4174
Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS

rh-mariadb103-galera-0:25.3.31-1.el7

Fixed · RHSA-2020:5246
Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS

rh-mariadb103-mariadb-3:10.3.27-1.el7

Fixed · RHSA-2020:5246
Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS

rh-mariadb102-galera-0:25.3.29-1.el7

Fixed · RHSA-2020:4174
Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS

rh-mariadb102-mariadb-1:10.2.33-1.el7

Fixed · RHSA-2020:4174
Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS

rh-mariadb103-galera-0:25.3.31-1.el7

Fixed · RHSA-2020:5246
Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS

rh-mariadb103-mariadb-3:10.3.27-1.el7

Fixed · RHSA-2020:5246
Red Hat OpenStack Platform 13 (Queens)

mariadb

Not affected

Product	Package	State	Advisory
Red Hat Enterprise Linux 8	mariadb-connector-c-0:3.1.11-2.el8_3	Fixed	RHSA-2020:5503
Red Hat Enterprise Linux 8	mariadb:10.3-8030020201203011231.229f0a1c	Fixed	RHSA-2020:5500
Red Hat Enterprise Linux 8.0 Update Services for SAP Solutions	mariadb-connector-c-0:3.1.11-2.el8_0	Fixed	RHSA-2020:5662
Red Hat Enterprise Linux 8.0 Update Services for SAP Solutions	mariadb:10.3-8000020201221114409.f8e95b4e	Fixed	RHSA-2020:5663
Red Hat Enterprise Linux 8.1 Extended Update Support	mariadb-connector-c-0:3.1.11-2.el8_1	Fixed	RHSA-2020:5660
Red Hat Enterprise Linux 8.1 Extended Update Support	mariadb:10.3-8010020201214133427.c27ad7f8	Fixed	RHSA-2020:5665
Red Hat Enterprise Linux 8.2 Extended Update Support	mariadb-connector-c-0:3.1.11-2.el8_2	Fixed	RHSA-2020:5655
Red Hat Enterprise Linux 8.2 Extended Update Support	mariadb:10.3-8020020201214133105.4cda2c84	Fixed	RHSA-2020:5654
Red Hat Software Collections for Red Hat Enterprise Linux 6	rh-mariadb102-galera-0:25.3.29-1.el6	Fixed	RHSA-2020:4174
Red Hat Software Collections for Red Hat Enterprise Linux 6	rh-mariadb102-mariadb-1:10.2.33-1.el6	Fixed	RHSA-2020:4174
Red Hat Software Collections for Red Hat Enterprise Linux 7	rh-mariadb102-galera-0:25.3.29-1.el7	Fixed	RHSA-2020:4174
Red Hat Software Collections for Red Hat Enterprise Linux 7	rh-mariadb102-mariadb-1:10.2.33-1.el7	Fixed	RHSA-2020:4174
Red Hat Software Collections for Red Hat Enterprise Linux 7	rh-mariadb103-galera-0:25.3.31-1.el7	Fixed	RHSA-2020:5246
Red Hat Software Collections for Red Hat Enterprise Linux 7	rh-mariadb103-mariadb-3:10.3.27-1.el7	Fixed	RHSA-2020:5246
Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS	rh-mariadb102-galera-0:25.3.29-1.el7	Fixed	RHSA-2020:4174
Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS	rh-mariadb102-mariadb-1:10.2.33-1.el7	Fixed	RHSA-2020:4174
Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS	rh-mariadb103-galera-0:25.3.31-1.el7	Fixed	RHSA-2020:5246
Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS	rh-mariadb103-mariadb-3:10.3.27-1.el7	Fixed	RHSA-2020:5246
Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS	rh-mariadb102-galera-0:25.3.29-1.el7	Fixed	RHSA-2020:4174
Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS	rh-mariadb102-mariadb-1:10.2.33-1.el7	Fixed	RHSA-2020:4174
Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS	rh-mariadb103-galera-0:25.3.31-1.el7	Fixed	RHSA-2020:5246
Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS	rh-mariadb103-mariadb-3:10.3.27-1.el7	Fixed	RHSA-2020:5246
Red Hat OpenStack Platform 13 (Queens)	mariadb	Not affected	n/a

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-20

Improper Input Validation

References (11)

http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00064.html
vendor-advisoryx_refsource_SUSEMailing ListThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00054.html
vendor-advisoryx_refsource_SUSEBroken LinkMailing ListThird Party Advisory
https://access.redhat.com/security/cve/CVE-2020-13249
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1839827
Issue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-5514
Advisory
https://github.com/mariadb-corporation/mariadb-connector-c/commit/2759b87d72926b7c9b5426437a7c8dd15ff57945
x_refsource_MISCPatchThird Party Advisory
https://github.com/mariadb-corporation/mariadb-connector-c/compare/v3.1.7...v3.1.8
x_refsource_MISCRelease NotesThird Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UW2ED32VEUHXFN2J3YQE27JIBV4SC2PI/
vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X4X2BMF3EILMTXGOZDTPYS3KT5VWLA2P/
vendor-advisoryx_refsource_FEDORA
https://nvd.nist.gov/vuln/detail/CVE-2020-13249
https://www.cve.org/CVERecord?id=CVE-2020-13249

Link	Providers	Tags
http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00064.html		vendor-advisoryx_refsource_SUSEMailing ListThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00054.html		vendor-advisoryx_refsource_SUSEBroken LinkMailing ListThird Party Advisory
https://access.redhat.com/security/cve/CVE-2020-13249		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1839827		Issue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-5514		Advisory
https://github.com/mariadb-corporation/mariadb-connector-c/commit/2759b87d72926b7c9b5426437a7c8dd15ff57945		x_refsource_MISCPatchThird Party Advisory
https://github.com/mariadb-corporation/mariadb-connector-c/compare/v3.1.7...v3.1.8		x_refsource_MISCRelease NotesThird Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UW2ED32VEUHXFN2J3YQE27JIBV4SC2PI/		vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X4X2BMF3EILMTXGOZDTPYS3KT5VWLA2P/		vendor-advisoryx_refsource_FEDORA
https://nvd.nist.gov/vuln/detail/CVE-2020-13249
https://www.cve.org/CVERecord?id=CVE-2020-13249

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published May 20, 2020

Updated Aug 4, 2024

Reserved May 20, 2020

Link CVE-2020-13249

CISA Vulnrichment

No data

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2020-13249

Red Hat

Severity Moderate

Public date May 20, 2020

Bugzilla 1839827

Link CVE-2020-13249

ENISA EUVD

Assigner mitre

Published May 20, 2020

Updated Aug 4, 2024

Link EUVD-2020-5514

GitHub

No data