CVE-2020-2574

Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are affected are 5.6.46 and prior, 5.7.28 and prior and 8.0.18 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Client. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Client. CVSS 3.0 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H).

References

Affected packages

Git / github.com/mariadb/server

Affected ranges

Type: GIT
Repo: https://github.com/mariadb/server
Events: Introduced

20ae591abd0bfe1bfaee546989ee163f4ef832b1

Fixed

0152704ae3f857668dbc05803950adcf131b8685

Introduced

9664240c948a92c22ccda0e1f5a420eb776ddcb1

Fixed

0a891ad6a6ba698484ba71171c3aa793705b8c6a

Introduced

5bfe1a3917ee1bddc7f2cde0c88961875148873c

Fixed

4d1c1b23e1373bbd4e72f524e855f1db076d2c73

Introduced

c235de12ae3723b96944337bd89ad9cc87f21d8f

Fixed

84d4005bad1abc45c5baac581ae26a563dea14bb

Introduced

c761b43451d54eeeecdf3c102906fcce88d4e9d9

Fixed

ba6bfc402c352372cc1a9ec20b5dc50b2204549f

Affected versions

mariadb-10.*

mariadb-10.0.31

mariadb-10.0.32

mariadb-10.0.33

mariadb-10.0.34

mariadb-10.0.35

mariadb-10.0.36

mariadb-10.0.37

mariadb-10.0.38

mariadb-10.1.23

mariadb-10.1.24

mariadb-10.1.25

mariadb-10.1.26

mariadb-10.1.27

mariadb-10.1.28

mariadb-10.1.29

mariadb-10.1.30

mariadb-10.1.31

mariadb-10.1.32

mariadb-10.1.33

mariadb-10.1.34

mariadb-10.1.35

mariadb-10.1.36

mariadb-10.1.37

mariadb-10.1.38

mariadb-10.1.39

mariadb-10.1.40

mariadb-10.1.41

mariadb-10.1.42

mariadb-10.1.43

mariadb-10.2.10

mariadb-10.2.11

mariadb-10.2.12

mariadb-10.2.13

mariadb-10.2.14

mariadb-10.2.15

mariadb-10.2.16

mariadb-10.2.17

mariadb-10.2.18

mariadb-10.2.19

mariadb-10.2.20

mariadb-10.2.21

mariadb-10.2.22

mariadb-10.2.23

mariadb-10.2.24

mariadb-10.2.25

mariadb-10.2.26

mariadb-10.2.27

mariadb-10.2.28

mariadb-10.2.29

mariadb-10.2.30

mariadb-10.2.6

mariadb-10.2.7

mariadb-10.2.8

mariadb-10.2.9

mariadb-10.3.0

mariadb-10.3.1

mariadb-10.3.10

mariadb-10.3.11

mariadb-10.3.12

mariadb-10.3.13

mariadb-10.3.14

mariadb-10.3.15

mariadb-10.3.16

mariadb-10.3.17

mariadb-10.3.18

mariadb-10.3.19

mariadb-10.3.2

mariadb-10.3.20

mariadb-10.3.21

mariadb-10.3.3

mariadb-10.3.4

mariadb-10.3.5

mariadb-10.3.6

mariadb-10.3.7

mariadb-10.3.8

mariadb-10.3.9

mariadb-5.*

mariadb-5.5.55

mariadb-5.5.56

mariadb-5.5.57

mariadb-5.5.58

mariadb-5.5.59

mariadb-5.5.60

mariadb-5.5.61

mariadb-5.5.62

mariadb-5.5.63

mariadb-5.5.64

mariadb-5.5.65

mariadb-5.5.66

mariadb-5.5.67

mariadb-galera-10.*

mariadb-galera-10.0.30

mariadb-galera-10.0.31

mariadb-galera-10.0.32

mariadb-galera-10.0.33

mariadb-galera-10.0.34

mariadb-galera-10.0.35

mariadb-galera-10.0.36

mariadb-galera-10.0.37

mariadb-galera-5.*

mariadb-galera-5.5.52

mariadb-galera-5.5.53

mariadb-galera-5.5.54

mariadb-galera-5.5.55

mariadb-galera-5.5.56

mariadb-galera-5.5.57

mariadb-galera-5.5.58

mariadb-galera-5.5.59

mariadb-galera-5.5.60

mariadb-galera-5.5.61

mariadb-galera-5.5.62

mysql-5.*

mysql-5.5.55

mysql-5.5.56

mysql-5.5.57

mysql-5.5.58

mysql-5.5.59

mysql-5.5.60

mysql-5.5.61

mysql-5.5.62

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2020-2574.json"

vanir_signatures

[
    {
        "signature_version": "v1",
        "signature_type": "Line",
        "source": "https://github.com/mariadb/server/commit/4d1c1b23e1373bbd4e72f524e855f1db076d2c73",
        "target": {
            "file": "sql-common/client.c"
        },
        "deprecated": false,
        "id": "CVE-2020-2574-247b795c",
        "digest": {
            "line_hashes": [
                "252433806933085366420702721037503420292",
                "261544691523631321679142379015874160011",
                "7699705637444748925595608774843986708",
                "115470899182411156247643435634697836284"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_version": "v1",
        "signature_type": "Function",
        "source": "https://github.com/mariadb/server/commit/4d1c1b23e1373bbd4e72f524e855f1db076d2c73",
        "target": {
            "function": "send_server_handshake_packet",
            "file": "sql/sql_acl.cc"
        },
        "deprecated": false,
        "id": "CVE-2020-2574-5f1af619",
        "digest": {
            "length": 2164.0,
            "function_hash": "262053342286479299849123738816776712772"
        }
    },
    {
        "signature_version": "v1",
        "signature_type": "Function",
        "source": "https://github.com/mariadb/server/commit/4d1c1b23e1373bbd4e72f524e855f1db076d2c73",
        "target": {
            "function": "CLI_MYSQL_REAL_CONNECT",
            "file": "sql-common/client.c"
        },
        "deprecated": false,
        "id": "CVE-2020-2574-8dedec31",
        "digest": {
            "length": 13090.0,
            "function_hash": "70481074292795631243999841673834314101"
        }
    },
    {
        "signature_version": "v1",
        "signature_type": "Line",
        "source": "https://github.com/mariadb/server/commit/4d1c1b23e1373bbd4e72f524e855f1db076d2c73",
        "target": {
            "file": "sql/sql_acl.cc"
        },
        "deprecated": false,
        "id": "CVE-2020-2574-a4b6dbc3",
        "digest": {
            "line_hashes": [
                "99489612520137149134503524235614005584",
                "231833035654469486984772267667153937447",
                "64006901634916951289469580350286748865",
                "162251870262657824737368113910973120880"
            ],
            "threshold": 0.9
        }
    }
]