CVE-2020-2580: Medium severity Oracle MySQL vulnerability
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.17 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.
External References:
https://www.oracle.com/security-alerts/cpujan2020.html
Other sources
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.17 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/mysqlto a version that resolves this vulnerability.Fixed in 8.0.18 - Compensating control
Mitigate the risk of denial of service by restricting network access to the MySQL Server (limit which hosts/networks can reach the exposed MySQL protocols) until the fixed release is applied.
Event History
Frequently Asked Questions
Who can exploit this issue?
Exploitation requires a high-privileged attacker with network access to the MySQL Server through multiple protocols. No user interaction is required.
What is the impact if exploitation succeeds?
A successful attack can cause the MySQL Server to hang or repeatedly crash, resulting in a complete denial of service. The provided CVSS vector indicates no confidentiality or integrity impact.
Which MySQL versions are identified as affected?
Affected supported Oracle MySQL Server versions are 8.0.17 and earlier.