CVE-2022-26944: Medium severity percona xtrabackup vulnerability
Percona XtraBackup 2.4.20 unintentionally writes the command line to any resulting backup file output. This may include sensitive arguments passed at run time. In addition, when --history is passed at run time, this command line is also written to the PERCONASCHEMA.xtrabackuphistory table. NOTE: this issue exists because of an incomplete fix for CVE-2020-10997.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-26944?
CVE-2022-26944 is a vulnerability in Percona XtraBackup 2.4.20 where the command line used to create a backup file is unintentionally written to the backup file, potentially exposing sensitive arguments.
How does CVE-2022-26944 affect Percona XtraBackup?
CVE-2022-26944 affects Percona XtraBackup 2.4.20 as it inadvertently writes the command line used to create a backup file to the output, which may include sensitive arguments passed at runtime.
What is the severity of CVE-2022-26944?
The severity of CVE-2022-26944 is medium, with a CVSS score of 6.5.
How can I fix CVE-2022-26944?
To fix CVE-2022-26944, upgrade to Percona XtraBackup 2.4.25 or later.
Where can I find more information about CVE-2022-26944?
More information about CVE-2022-26944 can be found in the release notes for Percona XtraBackup 2.4.25 and in the associated JIRA ticket.