CVE-2018-2696: High severity ORACLE MySQL vulnerability
It was discovered that the MySQL's sha256password authentication plugin did not restrict the length password received from authenticating client before passing it to the mycryptgenhash() function. This function implements SHA256 crypt password hashing algorithm that can also be used for hashing passwords in /etc/shadow on Linux systems. The algorithm is computationally intensive, and an excessively long passwords cause mysqld thread handling specific connection to consume all available CPU time. Additionally, the algorithm implementation in MySQL uses alloca() for memory allocation, which does not protect against stack overflow, possibly leading to memory corruption, process crash, and potentially code execution.
Note that this issue affects deployments where non-default sha256password authentication is configured for some or all database users.
Other sources
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server : Security : Privileges). Supported versions that are affected are 5.6.38 and prior and 5.7.20 and prior. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2018-2696?
CVE-2018-2696 is considered a critical vulnerability due to the potential for unauthorized access through inadequate password length restriction.
How do I fix CVE-2018-2696?
To fix CVE-2018-2696, upgrade your MySQL to version 5.6.39 or 5.7.21 or later versions.
What versions of MySQL are affected by CVE-2018-2696?
CVE-2018-2696 affects MySQL versions lower than 5.6.39 and 5.7.21.
How does CVE-2018-2696 impact MySQL security?
CVE-2018-2696 can lead to a potential denial-of-service condition or unauthorized access due to improper handling of password lengths.
Is there a workaround for CVE-2018-2696?
There is no known workaround for CVE-2018-2696, thus upgrading is the recommended action.