CVE-2018-2819

moderate-risk

Published 2018-04-19

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Supported versions that are affected are 5.5.59 and prior, 5.6.39 and prior and 5.7.21 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

Do I need to act?

0.27% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 6.5/10 Medium

NETWORK / LOW complexity

Affected Products (20)

Mysql

Mariadb

Ubuntu Linux

Debian Linux

Openstack

Enterprise Linux Desktop

Enterprise Linux Eus

Enterprise Linux Server

Enterprise Linux Server Aus

Enterprise Linux Server Tus

Affected Vendors

Debian Redhat Oracle Canonical Mariadb Netapp

References (34)

Patch http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html

Third Party Advisory http://www.securityfocus.com/bid/103814

Broken Link http://www.securitytracker.com/id/1040698

Third Party Advisory https://access.redhat.com/errata/RHSA-2018:1254

Third Party Advisory https://access.redhat.com/errata/RHSA-2018:2439

Third Party Advisory https://access.redhat.com/errata/RHSA-2018:2729

Third Party Advisory https://access.redhat.com/errata/RHSA-2018:3655

Third Party Advisory https://access.redhat.com/errata/RHSA-2019:1258

Mailing List https://lists.debian.org/debian-lts-announce/2018/04/msg00020.html

Mailing List https://lists.debian.org/debian-lts-announce/2018/06/msg00015.html

Third Party Advisory https://security.gentoo.org/glsa/201908-24

Third Party Advisory https://security.netapp.com/advisory/ntap-20180419-0002/

Third Party Advisory https://usn.ubuntu.com/3629-1/

Third Party Advisory https://usn.ubuntu.com/3629-2/

Third Party Advisory https://usn.ubuntu.com/3629-3/

Third Party Advisory https://www.debian.org/security/2018/dsa-4176

Third Party Advisory https://www.debian.org/security/2018/dsa-4341

Patch http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html

Third Party Advisory http://www.securityfocus.com/bid/103814

Broken Link http://www.securitytracker.com/id/1040698

and 14 more references

/ 100

moderate-risk

Severity 24/34 · High

Exploitability 1/34 · Minimal

Exposure 21/34 · High