CVE-2018-2703: Medium severity ORACLE MySQL vulnerability

The MySQL's sha256password authentication plugin uses SHA256 crypt password hashing algorithm as defined in:

https://www.akkadia.org/drepper/SHA-crypt.txt

to hash user passwords for storing. This algorithm makes it possible to adjust how expensive it is to compute password hash by adjusting the number of "rounds" of hashing. The number of rounds is stored as part of a password hash. The algorithm specification also defines the minimum and maximum number of rounds that can be used. It was previously identified that the maximum number is rather high and causes hash computation to take excessive amount of time:

https://sourceware.org/bugzilla/showbug.cgi?id=20616

However, this problem is only relevant if user can set their password in a system using SHA256 crypt by directly providing a malicious hash, and does not affect use case where users can only provide plain text passwords with hashing done by the system.

In MySQL 5.6, users with SQL access can set their password by directly providing password hash using: SET PASSWORD = '<hash>'; In MySQL 5.7, the <hash> string is considered to be a plain text password and is hashed again by the MySQL server. Refer to the 'SET PASSWORD' syntax description in the MySQL 5.6 and 5.7 documentation:

https://dev.mysql.com/doc/refman/5.6/en/set-password.html https://dev.mysql.com/doc/refman/5.7/en/set-password.html

Therefore in MySQL 5.6, a user with SQL access can set a password hash with many rounds for their account. Any subsequent attempt to authenticate to that account will cause MySQL server to use an excessive amount of CPU.

— Red Hat

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server : Security : Privileges). Supported versions that are affected are 5.6.38 and prior and 5.7.20 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

— Launchpad