CVE-2020-7221: High severity MariaDB MariaDB vulnerability
mysqlinstalldb in MariaDB 10.4.7 through 10.4.11 allows privilege escalation from the mysql user account to root because chown and chmod are performed unsafely, as demonstrated by a symlink attack on a chmod 04755 of authpamtooldir/authpamtool. NOTE: this does not affect the Oracle MySQL product, which implements mysqlinstalldb differently.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2020-7221?
CVE-2020-7221 is classified as a high severity vulnerability due to its potential for privilege escalation.
How can I mitigate CVE-2020-7221?
To mitigate CVE-2020-7221, upgrade to MariaDB version 10.4.12 or later, where the vulnerability has been addressed.
Who is affected by CVE-2020-7221?
CVE-2020-7221 affects users of MariaDB versions 10.4.7 through 10.4.11 on systems utilizing the mysql_install_db script.
What type of attack does CVE-2020-7221 facilitate?
CVE-2020-7221 facilitates a symlink attack that allows privilege escalation from the mysql user to root.
Is CVE-2020-7221 specific to MariaDB or does it affect Oracle MySQL?
CVE-2020-7221 specifically affects certain versions of MariaDB and does not impact Oracle MySQL.