CVE-2020-15180

CRITICAL9.0EPSS 4.6%

mariadb-10.3 - security update

發布日:2021/5/27修改日:2026/4/28

描述

A flaw was found in the mysql-wsrep component of mariadb. Lack of input sanitization in `wsrep_sst_method` allows for command injection that can be exploited by a remote attacker to execute arbitrary commands on galera cluster nodes. This threatens the system's confidentiality, integrity, and availability. This flaw affects mariadb versions before 10.1.47, before 10.2.34, before 10.3.25, before 10.4.15 and before 10.5.6.

受影響套件(7)

Alpine/mariadbfrom 0, < 10.3.25-r0
Bitnami/mariadb>= 10.1.0, < 10.1.47, >= 10.2.0, < 10.2.34, >= 10.3.0, < 10.3.25, >= 10.4.0, < 10.4.15, >= 10.5.0, < 10.5.6
Bitnami/mariadb-min>= 10.1.0, < 10.1.47, >= 10.2.0, < 10.2.34, >= 10.3.0, < 10.3.25, >= 10.4.0, < 10.4.15, >= 10.5.0, < 10.5.6
Bitnami/mysql-client>= 10.1.0, < 10.1.47, >= 10.2.0, < 10.2.34, >= 10.3.0, < 10.3.25, >= 10.4.0, < 10.4.15, >= 10.5.0, < 10.5.6
Debian/mariadb-10.1from 0, < 10.1.47-0+deb9u1
Debian/mariadb-10.3from 0, < 1:10.3.25-0+deb10u1
Debian/mariadb-10.5from 0, < 1:10.5.6-1

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	CRITICAL9.0	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

描述

受影響套件(7)

CVSS 分數

參考連結(8)