CVE-2020-2570: Medium severity ORACLE MySQL vulnerability
A vulnerability was found in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are affected are 5.7.28 and prior and 8.0.18 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Client. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Client.
Reference: https://www.oracle.com/security-alerts/cpujan2020.html
Other sources
Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are affected are 5.7.28 and prior and 8.0.18 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Client. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Client. CVSS 3.0 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H).
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/mysqlto a version that resolves this vulnerability.Fixed in 5.7.29 - Upgrade
Upgrade
redhat/mysqlto a version that resolves this vulnerability.Fixed in 8.0.19 - Upgrade
Upgrade
Oracle MySQL MySQL Client (C API)to a version that resolves this vulnerability.Fixed in 8.0.18 - Upgrade
Upgrade
Oracle MySQL MySQL Client (C API)to a version that resolves this vulnerability.Fixed in 5.7.28
Event History
Frequently Asked Questions
What is the severity of CVE-2020-2570?
CVE-2020-2570 has been classified as a difficult to exploit vulnerability affecting specific versions of MySQL.
How do I fix CVE-2020-2570?
To address CVE-2020-2570, upgrade MySQL to version 5.7.29 or 8.0.19 or later.
Which MySQL versions are affected by CVE-2020-2570?
CVE-2020-2570 affects MySQL versions 5.7.28 and prior and 8.0.18 and prior.
Who can exploit CVE-2020-2570?
CVE-2020-2570 can be exploited by unauthenticated attackers with network access.
What protocols are involved in CVE-2020-2570 exploitation?
CVE-2020-2570 can be compromised via multiple network protocols.