CVE-2013-6394: Low severity Percona XtraBackup vulnerability
Published Dec 13, 2013
·Updated
Percona XtraBackup before 2.1.6 uses a constant string for the initialization vector (IV), which makes it easier for local users to defeat cryptographic protection mechanisms and conduct plaintext attacks.
Affected Software
9 affected components
Percona XtraBackup<=2.1.5
Percona XtraBackup=2.1.0-alpha1
Percona XtraBackup=2.1.0-beta1
Percona XtraBackup=2.1.0-rc1
Percona XtraBackup=2.1.1
Percona XtraBackup=2.1.2
Percona XtraBackup=2.1.3
Percona XtraBackup=2.1.4
openSUSE openSUSE=13.1
Remediation
Event History
Dec 13, 2013
CVE Published
via MITRE·06:00 PM
Data Sourced
via MITRE·06:00 PM
Description
Data Sourced
via NVD·06:07 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2013-6394?
CVE-2013-6394 is rated as a moderate severity vulnerability due to its potential to weaken cryptographic protections.
2
How do I fix CVE-2013-6394?
To fix CVE-2013-6394, upgrade to Percona XtraBackup version 2.1.6 or later.
3
Who is affected by CVE-2013-6394?
CVE-2013-6394 affects all versions of Percona XtraBackup prior to 2.1.6 as well as specific alpha, beta, and release candidate versions.
4
What type of vulnerabilities does CVE-2013-6394 involve?
CVE-2013-6394 involves cryptographic vulnerabilities due to the use of a constant initialization vector.
5
Can local users exploit CVE-2013-6394?
Yes, local users can exploit CVE-2013-6394 to conduct plaintext attacks against encrypted data.