CVE-2017-15365: High severity fedoraproject fedora vulnerability
MariaDB have noted in their release notes that reserved CVE-2017-15365 has been fixed in version 10.2.10[1], however they have not described how or what the vulnerability was. This CVE is also mentioned to affect Percona[2] with the fix is described as:
"Added access checks for DDL commands to make sure they do not get replicated if they failed without proper permissions"
A comparison with the MariaDB 10.2.10 changelog[3] and Percona description finds this commit[4], which seems a likely candidate for both describing and fixing the vulnerability. The vulnerable code block in sql/eventdataobjects.cc is also present in version 10.1, suggesting that it is also affected.
[0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15365 [1] https://mariadb.com/kb/en/library/mariadb-10210-release-notes/ [2] https://www.percona.com/doc/percona-xtradb-cluster/LATEST/release-notes/Percona-XtraDB-Cluster-5.7.19-29.22-3.html [3] https://mariadb.com/kb/en/library/mariadb-10210-changelog/ [4] https://github.com/MariaDB/server/commit/0b5a5258abbeaf8a0c3a18c7e753699787fdf46e
Other sources
sql/eventdataobjects.cc in MariaDB before 10.1.30 and 10.2.x before 10.2.10 and Percona XtraDB Cluster before 5.6.37-26.21-3 and 5.7.x before 5.7.19-29.22-3 allows remote authenticated users with SQL access to bypass intended access restrictions and replicate data definition language (DDL) statements to cluster nodes by leveraging incorrect ordering of DDL replication and ACL checking.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2017-15365?
CVE-2017-15365 is a vulnerability in MariaDB and Percona XtraDB Cluster that allows remote authenticated users to bypass intended access restrictions and replicate data definition language (DDL) statements.
How severe is CVE-2017-15365?
CVE-2017-15365 has a severity score of 8.8, which is considered high.
Which software versions are affected by CVE-2017-15365?
MariaDB versions before 10.1.30 and 10.2.x before 10.2.10, and Percona XtraDB Cluster before 5.6.37-26.21-3 and 5.7.x before 5.7.19-29.22-3 are affected by CVE-2017-15365.
How can I fix CVE-2017-15365?
To fix CVE-2017-15365, you should upgrade your MariaDB version to 10.1.30 or later, or upgrade Percona XtraDB Cluster to 5.6.37-26.21-3 or later.
Where can I find more information about CVE-2017-15365?
You can find more information about CVE-2017-15365 at the following references: [Red Hat Security Advisory](https://access.redhat.com/errata/RHSA-2019:1258), [Red Hat Bugzilla](https://bugzilla.redhat.com/show_bug.cgi?id=1524234), [MariaDB Commit](https://github.com/MariaDB/server/commit/0b5a5258abbeaf8a0c3a18c7e753699787fdf46e).