RHSA-2010:0109: Moderate: mysql security update

MySQL is a multi-user, multi-threaded SQL database server. It consists ofthe MySQL server daemon (mysqld) and many client programs and libraries.It was discovered that the MySQL client ignored certain SSL certificateverification errors when connecting to servers. A man-in-the-middleattacker could use this flaw to trick MySQL clients into connecting to aspoofed MySQL server. (CVE-2009-4028)Note: This fix may uncover previously hidden SSL configuration issues, suchas incorrect CA certificates being used by clients or expired servercertificates. This update should be carefully tested in deployments whereSSL connections are used.A flaw was found in the way MySQL handled SELECT statements with subqueriesin the WHERE clause, that assigned results to a user variable. A remote,authenticated attacker could use this flaw to crash the MySQL server daemon(mysqld). This issue only caused a temporary denial of service, as theMySQL daemon was automatically restarted after the crash. (CVE-2009-4019)When the "datadir" option was configured with a relative path, MySQL didnot properly check paths used as arguments for the DATA DIRECTORY and INDEXDIRECTORY directives. An authenticated attacker could use this flaw tobypass the restriction preventing the use of subdirectories of the MySQLdata directory being used as DATA DIRECTORY and INDEX DIRECTORY paths.(CVE-2009-4030)Note: Due to the security risks and previous security issues related to theuse of the DATA DIRECTORY and INDEX DIRECTORY directives, users notdepending on this feature should consider disabling it by adding"symbolic-links=0" to the "[mysqld]" section of the "my.cnf" configurationfile. In this update, an example of such a configuration was added to thedefault "my.cnf" file.All MySQL users are advised to upgrade to these updated packages, whichcontain backported patches to resolve these issues. After installing thisupdate, the MySQL server daemon (mysqld) will be restarted automatically.