CVE-2015-3152: Medium severity mysql vulnerability
Oracle MySQL before 5.7.3, Oracle MySQL Connector/C (aka libmysqlclient) before 6.1.3, and MariaDB before 5.5.44 use the --ssl option to mean that SSL is optional, which allows man-in-the-middle attackers to spoof servers via a cleartext-downgrade attack, aka a "BACKRONYM" attack.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2015-3152?
CVE-2015-3152 is considered a moderate severity vulnerability that can allow man-in-the-middle attacks due to SSL misconfiguration.
How do I fix CVE-2015-3152?
To fix CVE-2015-3152, upgrade to Oracle MySQL version 5.7.3 or later, Oracle MySQL Connector/C version 6.1.3 or later, or MariaDB version 5.5.44 or later.
What type of attack does CVE-2015-3152 enable?
CVE-2015-3152 enables cleartext-downgrade attacks, allowing attackers to spoof server communications.
Which software versions are affected by CVE-2015-3152?
CVE-2015-3152 affects Oracle MySQL versions before 5.7.3, Oracle MySQL Connector/C versions before 6.1.3, and multiple MariaDB versions prior to 5.5.44.
Is SSL mandatory for connections when using affected versions related to CVE-2015-3152?
In the affected versions related to CVE-2015-3152, the SSL option is interpreted as optional, which can lead to security vulnerabilities.