CVE-2018-2622

moderate-risk

Published 2018-01-18

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL). Supported versions that are affected are 5.5.58 and prior, 5.6.38 and prior and 5.7.20 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

Do I need to act?

0.40% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 6.5/10 Medium

NETWORK / LOW complexity

Affected Products (20)

Mysql

Mariadb

Debian Linux

Ubuntu Linux

Active Iq Unified Manager

Oncommand Insight

Oncommand Workflow Automation

Snapcenter

Openstack

Enterprise Linux Desktop

Enterprise Linux Eus

Enterprise Linux Server

Affected Vendors

Debian Redhat Oracle Canonical Mariadb Netapp

References (30)

Patch http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html

Third Party Advisory http://www.securityfocus.com/bid/102706

Broken Link http://www.securitytracker.com/id/1040216

Third Party Advisory https://access.redhat.com/errata/RHSA-2018:0586

Third Party Advisory https://access.redhat.com/errata/RHSA-2018:0587

Third Party Advisory https://access.redhat.com/errata/RHSA-2018:2439

Third Party Advisory https://access.redhat.com/errata/RHSA-2018:2729

Third Party Advisory https://access.redhat.com/errata/RHSA-2019:1258

Mailing List https://lists.debian.org/debian-lts-announce/2018/01/msg00024.html

Mailing List https://lists.debian.org/debian-lts-announce/2018/06/msg00015.html

Third Party Advisory https://security.netapp.com/advisory/ntap-20180117-0002/

Third Party Advisory https://usn.ubuntu.com/3537-1/

Third Party Advisory https://usn.ubuntu.com/3537-2/

Third Party Advisory https://www.debian.org/security/2018/dsa-4091

Third Party Advisory https://www.debian.org/security/2018/dsa-4341

Patch http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html

Third Party Advisory http://www.securityfocus.com/bid/102706

Broken Link http://www.securitytracker.com/id/1040216

Third Party Advisory https://access.redhat.com/errata/RHSA-2018:0586

Third Party Advisory https://access.redhat.com/errata/RHSA-2018:0587

and 10 more references

/ 100

moderate-risk

Severity 24/34 · High

Exploitability 2/34 · Minimal

Exposure 21/34 · High