CVE-2017-3331: Medium severity ORACLE MySQL vulnerability

Q: What is the severity of CVE-2017-3331?

CVE-2017-3331 has been rated as an easily exploitable vulnerability, allowing low privileged attackers to compromise MySQL Server.

Q: How do I fix CVE-2017-3331?

To fix CVE-2017-3331, upgrade MySQL Server to version 5.7.18 or later.

Q: Which versions of MySQL are affected by CVE-2017-3331?

MySQL versions 5.7.11 through 5.7.17 are affected by CVE-2017-3331.

Q: What are the potential impacts of CVE-2017-3331?

The impact of CVE-2017-3331 includes potential unauthorized access and compromise of the MySQL Server.

Q: Who is at risk for CVE-2017-3331?

Organizations using MySQL versions 5.7.11 to 5.7.17 are at risk for CVE-2017-3331.

Published Apr 19, 2017

Updated

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DML). The supported version that is affected is 5.7.11 to 5.7.17. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.

External References:

http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html#AppendixMSQL

Other sources

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DML). The supported version that is affected is 5.7.11 to 5.7.17. Easily "exploitable" vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

— MITRE

Affected Software

8 affected componentsFixes available

redhat/mysql<5.7.18

5.7.18

ORACLE MySQL=5.7.11

ORACLE MySQL=5.7.12

ORACLE MySQL=5.7.13

ORACLE MySQL=5.7.14

ORACLE MySQL=5.7.15

ORACLE MySQL=5.7.16

ORACLE MySQL=5.7.17

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/mysql to a version that resolves this vulnerability.
Fixed in 5.7.18
Upgrade
Upgrade oracle/mysql/server to a version that resolves this vulnerability.
Fixed in 5.7.18

Event History

Apr 24, 2017

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

DescriptionWeakness

Data Sourced

via NVD·07:59 PM

RemedyDescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of CVE-2017-3331?

CVE-2017-3331 has been rated as an easily exploitable vulnerability, allowing low privileged attackers to compromise MySQL Server.

How do I fix CVE-2017-3331?