CVE-2016-2047
First published: Tue Jan 26 2016(Updated: )
The ssl_verify_server_cert function in sql-common/client.c in MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10; Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier; and Percona Server do not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a "/CN=" string in a field in a certificate, as demonstrated by "/OU=/CN=bar.com/CN=foo.com."
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/mysql | <5.5.48 | 5.5.48 |
| redhat/mysql | <5.6.29 | 5.6.29 |
| redhat/mysql | <5.7.11 | 5.7.11 |
| redhat/mariadb | <5.5.47 | 5.5.47 |
| redhat/mariadb | <10.1.10 | 10.1.10 |
| redhat/mariadb | <10.0.23 | 10.0.23 |
| MariaDB | >=5.5.20<5.5.47 | |
| MariaDB | >=10.0.0<10.0.23 | |
| MariaDB | >=10.1.0<10.1.10 | |
| Oracle Linux | =7 | |
| MySQL | >=5.5.0<=5.5.48 | |
| MySQL | >=5.6.0<=5.6.29 | |
| MySQL | >=5.7.0<=5.7.11 | |
| SUSE Linux | =42.1 | |
| Red Hat Enterprise Linux | =6.0 | |
| Red Hat Enterprise Linux | =7.0 | |
| Debian Linux | =8.0 | |
| Debian Linux | =9.0 | |
| Ubuntu | =12.04 | |
| Ubuntu | =14.04 | |
| Ubuntu | =15.10 | |
| Ubuntu | =16.04 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00035.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00053.html
- http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00033.html
- http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00034.html
- http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00051.html
- http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00053.html
- http://rhn.redhat.com/errata/RHSA-2016-0534.html
- http://rhn.redhat.com/errata/RHSA-2016-0705.html
- http://rhn.redhat.com/errata/RHSA-2016-1480.html
- http://rhn.redhat.com/errata/RHSA-2016-1481.html
- http://www.debian.org/security/2016/dsa-3453
- http://www.debian.org/security/2016/dsa-3557
- http://www.openwall.com/lists/oss-security/2016/01/26/3
- http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
- http://www.securityfocus.com/bid/81810
- http://www.securitytracker.com/id/1035606
- http://www.ubuntu.com/usn/USN-2953-1
- http://www.ubuntu.com/usn/USN-2954-1
- https://access.redhat.com/errata/RHSA-2016:1132
- https://mariadb.atlassian.net/browse/MDEV-9212
- https://mariadb.com/kb/en/mariadb/mariadb-10110-release-notes/
- https://mariadb.com/kb/en/mariadb/mariadb-5547-release-notes/
- https://mariadb.com/kb/en/mdb-10023-rn/
- https://github.com/MariaDB/server/commit/f0d774d48416bb06063184380b684380ca005a41
- https://rhn.redhat.com/errata/RHSA-2016-0534.html
- http://www.oracle.com/technetwork/topics/security/cpuapr2016-2881694.html#AppendixMSQL
- http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html#AppendixMSQL
- https://github.com/mysql/mysql-server/commit/13380bf81f6bc20d39549f531f9acebdfb5a8c37
- http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-49.html
- http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-30.html
- http://dev.mysql.com/doc/relnotes/mysql/5.7/en/news-5-7-12.html
- https://github.com/mysql/mysql-server/commit/e7061f7e5a96c66cb2e0bf46bec7f6ff35801a69
- https://rhn.redhat.com/errata/RHSA-2016-0705.html
- https://rhn.redhat.com/errata/RHSA-2016-1481.html
- https://rhn.redhat.com/errata/RHSA-2016-1480.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1301874
Frequently Asked Questions
What is the severity of CVE-2016-2047?
CVE-2016-2047 is classified as a medium severity vulnerability due to improper hostname verification.
How do I fix CVE-2016-2047?
To fix CVE-2016-2047, update your MariaDB, Oracle MySQL, or Percona Server to the recommended versions or later.
Which software is affected by CVE-2016-2047?
CVE-2016-2047 affects MariaDB, Oracle MySQL, and Percona Server versions before specific updates.
Are there any workarounds for CVE-2016-2047?
There are no specific workarounds for CVE-2016-2047; upgrading to a secure version is the recommended solution.
What can attack vectors exploit CVE-2016-2047?
CVE-2016-2047 could potentially be exploited by man-in-the-middle attacks due to the improper verification of server certificates.
- agent/type
- agent/first-publish-date
- agent/remedy
- agent/severity
- agent/weakness
- agent/references
- agent/author
- agent/description
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2016-2047
- agent/software-canonical-lookup
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- package-manager/redhat
- vendor/mariadb
- canonical/mariadb
- version/mariadb/5.5.20
- version/mariadb/10.0.0
- version/mariadb/10.1.0
- vendor/oracle
- canonical/oracle linux
- version/oracle linux/7
- canonical/mysql
- version/mysql/5.5.0
- version/mysql/5.5.48
- version/mysql/5.6.0
- version/mysql/5.6.29
- version/mysql/5.7.0
- version/mysql/5.7.11
- vendor/opensuse
- canonical/suse linux
- version/suse linux/42.1
- vendor/redhat
- canonical/red hat enterprise linux
- version/red hat enterprise linux/6.0
- version/red hat enterprise linux/7.0
- vendor/debian
- canonical/debian linux
- version/debian linux/8.0
- version/debian linux/9.0
- vendor/canonical
- canonical/ubuntu
- version/ubuntu/12.04
- version/ubuntu/14.04
- version/ubuntu/15.10
- version/ubuntu/16.04