CVE-2020-15180

A flaw was found in the mysql-wsrep component of mariadb. Lack of input sanitization in `wsrep_sst_method` allows for command injection that can be exploited by a remote attacker to execute arbitrary commands on galera cluster nodes. This threatens the system's confidentiality, integrity, and availability. This flaw affects mariadb versions before 10.1.47, before 10.2.34, before 10.3.25, before 10.4.15 and before 10.5.6.

Link	Resource
https://bugzilla.redhat.com/show_bug.cgi?id=1894919	Issue Tracking Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/10/msg00021.html	Mailing List Third Party Advisory
https://security.gentoo.org/glsa/202011-14	Third Party Advisory
https://www.percona.com/blog/2020/10/30/cve-2020-15180-affects-percona-xtradb-cluster/	Patch Third Party Advisory
https://www.debian.org/security/2020/dsa-4776	Third Party Advisory

Configuration 1

cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:* cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:* cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:* cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:* cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:* cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* cpe:2.3:a:percona:xtradb_cluster:*:*:*:*:*:*:*:* cpe:2.3:a:percona:xtradb_cluster:*:*:*:*:*:*:*:* cpe:2.3:a:percona:xtradb_cluster:*:*:*:*:*:*:*:* cpe:2.3:a:galeracluster:galera_cluster_for_mysql:*:*:*:*:*:*:*:* cpe:2.3:a:galeracluster:galera_cluster_for_mysql:*:*:*:*:*:*:*:* cpe:2.3:a:galeracluster:galera_cluster_for_mysql:*:*:*:*:*:*:*:*

---

Published : 2021-05-27 08:15

Updated : 2022-08-05 03:37

---

NVD link : CVE-2020-15180

Mitre link : CVE-2020-15180

No products.

CWE-77