CVE-2018-2767: Low severity Oracle MySQL vulnerability
Last updated 18 August 2025
Other sources
MySQL 5.5, MariaDB 5.5 and 10.3 have a vulnerability in the client library that does not enforce the use of SSL/TLS. Client applications that specify the use of SSL/TLS can result in established connections without SSL/TLS enabled and no reported error.
This is the result of an incomplete fix for CVE-2015-3152 (a.k.a BACKRONYM).
Reference:
http://www.openwall.com/lists/oss-security/2018/04/08/2
— Red Hat
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Encryption). Supported versions that are affected are 5.5.60 and prior, 5.6.40 and prior and 5.7.22 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Server accessible data. CVSS 3.0 Base Score 3.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N).
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2018-2767?
CVE-2018-2767 is classified with a moderate severity level due to its implications on data transmission security.
How do I fix CVE-2018-2767?
To fix CVE-2018-2767, update the MySQL or MariaDB packages to the recommended versions as outlined in the vulnerability reports.
Which applications are affected by CVE-2018-2767?
CVE-2018-2767 affects MySQL 5.5, MariaDB 5.5, and other specific versions noted in the vulnerability details.
What are the risks of not addressing CVE-2018-2767?
Not addressing CVE-2018-2767 can expose your database connections to potential man-in-the-middle attacks due to the lack of enforced SSL/TLS.
Is there a known workaround for CVE-2018-2767?
A temporary workaround for CVE-2018-2767 includes verifying existing configurations enforce SSL/TLS usage on client connections.