CVE-2015-1027: Infoleak
The version checking subroutine in percona-toolkit before 2.2.13 and xtrabackup before 2.2.9 was vulnerable to silent HTTP downgrade attacks and Man In The Middle attacks in which the server response could be modified to allow the attacker to respond with modified command payload and have the client return additional running configuration information leading to an information disclosure of running configuration of MySQL.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-1027?
CVE-2015-1027 is considered a high severity vulnerability due to its potential for Man In The Middle attacks.
How do I fix CVE-2015-1027?
To fix CVE-2015-1027, upgrade Percona Toolkit to version 2.2.13 or later and XtraBackup to version 2.2.9 or later.
What versions of software are affected by CVE-2015-1027?
CVE-2015-1027 affects Percona Toolkit versions up to 2.2.12 and XtraBackup versions up to 2.2.8.
What type of attacks can exploit CVE-2015-1027?
CVE-2015-1027 can be exploited through silent HTTP downgrade attacks and Man In The Middle attacks.
Is there a workaround for CVE-2015-1027 if I cannot upgrade?
There is no official workaround for CVE-2015-1027, and upgrading is the recommended action to mitigate the risk.