[Bug 1851014] New: CVE-2020-2934 mysql-connector-java: allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors which could result in unauthorized update, insert or delete
7:26 a.m.
https://bugzilla.redhat.com/show_bug.cgi?id=1851014
Bug ID: 1851014
Summary: CVE-2020-2934 mysql-connector-java: allows
unauthenticated attacker with network access via
multiple protocols to compromise MySQL Connectors
which could result in unauthorized update, insert or
delete
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: mkaplan(a)redhat.com
CC: aboyko(a)redhat.com, aileenc(a)redhat.com,
akoufoud(a)redhat.com, alazarot(a)redhat.com,
almorale(a)redhat.com, anstephe(a)redhat.com,
asoldano(a)redhat.com, atangrin(a)redhat.com,
avibelli(a)redhat.com, bbaranow(a)redhat.com,
bgeorges(a)redhat.com, bibryam(a)redhat.com,
bmaxwell(a)redhat.com, bmontgom(a)redhat.com,
brian.stansberry(a)redhat.com, cdewolf(a)redhat.com,
chazlett(a)redhat.com, clement.escoffier(a)redhat.com,
dandread(a)redhat.com, darran.lofthouse(a)redhat.com,
databases-maint(a)redhat.com, dkreling(a)redhat.com,
dosoudil(a)redhat.com, drieden(a)redhat.com,
eparis(a)redhat.com, etirelli(a)redhat.com,
ganandan(a)redhat.com, ggaughan(a)redhat.com,
gmalinko(a)redhat.com, gmorling(a)redhat.com,
gsmet(a)redhat.com, gvarsami(a)redhat.com,
hhorak(a)redhat.com, ibek(a)redhat.com, iweiss(a)redhat.com,
janstey(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jawilson(a)redhat.com, jbalunas(a)redhat.com,
jburrell(a)redhat.com, jcoleman(a)redhat.com,
jjanco(a)redhat.com, jochrist(a)redhat.com,
jokerman(a)redhat.com, jolee(a)redhat.com,
jpallich(a)redhat.com, jperkins(a)redhat.com,
jschatte(a)redhat.com, jstastny(a)redhat.com,
jwon(a)redhat.com, kconner(a)redhat.com,
krathod(a)redhat.com, kverlaen(a)redhat.com,
kwills(a)redhat.com, ldimaggi(a)redhat.com,
lgao(a)redhat.com, lthon(a)redhat.com, mmuzila(a)redhat.com,
mnovotny(a)redhat.com, mschorm(a)redhat.com,
msochure(a)redhat.com, msvehla(a)redhat.com,
mszynkie(a)redhat.com, nstielau(a)redhat.com,
nwallace(a)redhat.com, odubaj(a)redhat.com,
pantinor(a)redhat.com, paradhya(a)redhat.com,
pgallagh(a)redhat.com, pjindal(a)redhat.com,
pmackay(a)redhat.com, psotirop(a)redhat.com,
puntogil(a)libero.it, rguimara(a)redhat.com,
rrajasek(a)redhat.com, rruss(a)redhat.com,
rstancel(a)redhat.com, rsvoboda(a)redhat.com,
rsynek(a)redhat.com, rwagner(a)redhat.com,
sbiarozk(a)redhat.com, sdaley(a)redhat.com,
sdouglas(a)redhat.com, smaestri(a)redhat.com,
sponnaga(a)redhat.com, steve.traylen(a)cern.ch,
tcunning(a)redhat.com, tkirby(a)redhat.com,
tom.jenkinson(a)redhat.com, vhalbert(a)redhat.com,
xjakub(a)fi.muni.cz
Target Milestone: ---
Classification: Other
Vulnerability in the MySQL Connectors product of Oracle MySQL (component:
Connector/J). Supported versions that are affected are 8.0.14 and prior and
5.1.48 and prior. Difficult to exploit vulnerability allows unauthenticated
attacker with network access via multiple protocols to compromise MySQL
Connectors. Successful attacks require human interaction from a person other
than the attacker and while the vulnerability is in MySQL Connectors, attacks
may significantly impact additional products. Successful attacks of this
vulnerability can result in unauthorized update, insert or delete access to
some of MySQL Connectors accessible data as well as unauthorized read access to
a subset of MySQL Connectors accessible data
--
You are receiving this mail because:
You are on the CC list for the bug.
7:28 a.m.
New subject: [Bug 1851014] CVE-2020-2934 mysql-connector-java: allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors which could result in unauthorized update, insert or delete
https://bugzilla.redhat.com/show_bug.cgi?id=1851014
Michael Kaplan <mkaplan(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Depends On| |1851015
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1851015
[Bug 1851015] CVE-2020-2934 mysql-connector-java: allows unauthenticated
attacker with network access via multiple protocols to compromise MySQL
Connectors which could result in unauthorized update, insert or delete
[fedora-all]
--
You are receiving this mail because:
You are on the CC list for the bug.
7:28 a.m.
New subject: [Bug 1851014] CVE-2020-2934 mysql-connector-java: allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors which could result in unauthorized update, insert or delete
https://bugzilla.redhat.com/show_bug.cgi?id=1851014
--- Comment #1 from Michael Kaplan <mkaplan(a)redhat.com> ---
Created mysql-connector-java tracking bugs for this issue:
Affects: fedora-all [bug 1851015]
--
You are receiving this mail because:
You are on the CC list for the bug.
7:31 a.m.
New subject: [Bug 1851014] CVE-2020-2934 mysql-connector-java: allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors which could result in unauthorized update, insert or delete
https://bugzilla.redhat.com/show_bug.cgi?id=1851014
Michael Kaplan <mkaplan(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Priority|medium |low
Severity|medium |low
--
You are receiving this mail because:
You are on the CC list for the bug.
7:33 a.m.
New subject: [Bug 1851014] CVE-2020-2934 mysql-connector-java: allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors which could result in unauthorized update, insert or delete
https://bugzilla.redhat.com/show_bug.cgi?id=1851014
--- Comment #2 from Michael Kaplan <mkaplan(a)redhat.com> ---
References:
https://www.oracle.com/security-alerts/cpuapr2020.html
https://lists.debian.org/debian-lts-announce/2020/06/msg00015.html
https://www.debian.org/security/2020/dsa-4703
--
You are receiving this mail because:
You are on the CC list for the bug.
8:02 a.m.
New subject: [Bug 1851014] CVE-2020-2934 mysql-connector-java: allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors which could result in unauthorized update, insert or delete
https://bugzilla.redhat.com/show_bug.cgi?id=1851014
Michael Kaplan <mkaplan(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Blocks| |1851025
--
You are receiving this mail because:
You are on the CC list for the bug.
11:31 p.m.
New subject: [Bug 1851014] CVE-2020-2934 mysql-connector-java: allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors which could result in unauthorized update, insert or delete
https://bugzilla.redhat.com/show_bug.cgi?id=1851014
--- Comment #5 from Kunjan Rathod <krathod(a)redhat.com> ---
This vulnerability is out of security support scope for the following products:
* Red Hat Enterprise Application Platform 6
* Red Hat JBoss Data Virtualization & Services 6
* Red Hat JBoss Fuse Service Works(FSW) 6
Please refer to https://access.redhat.com/support/policy/updates/jboss_notes
for more details.
--
You are receiving this mail because:
You are on the CC list for the bug.
1:09 a.m.
New subject: [Bug 1851014] CVE-2020-2934 mysql-connector-java: allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors which could result in unauthorized update, insert or delete
https://bugzilla.redhat.com/show_bug.cgi?id=1851014
--- Doc Text *updated* by Doran Moppert <dmoppert(a)redhat.com> ---
A complicated attack against the mysql Connector/J could potentially allow attackers on
the local network to interfere with a user's connection, inserting unauthorized SQL
commands.
--
You are receiving this mail because:
You are on the CC list for the bug.
1:09 a.m.
New subject: [Bug 1851014] CVE-2020-2934 mysql-connector-java: allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors which could result in unauthorized update, insert or delete
https://bugzilla.redhat.com/show_bug.cgi?id=1851014
--- Comment #9 from Doran Moppert <dmoppert(a)redhat.com> ---
Statement:
Red Hat Enterprise Linux customers are advised to replace the
mysql-connector-java package with the mariadb-java-client, available in Red Hat
Software Collections. It can be installed this way:
# yum-config-manager --enable rhel-server-rhscl-7-rpms
# yum install rh-mariadb103-mariadb-java-client
--
You are receiving this mail because:
You are on the CC list for the bug.
11:39 a.m.
New subject: [Bug 1851014] CVE-2020-2934 mysql-connector-java: allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors which could result in unauthorized update, insert or delete
https://bugzilla.redhat.com/show_bug.cgi?id=1851014
Bug 1851014 depends on bug 1851015, which changed state.
Bug 1851015 Summary: CVE-2020-2934 mysql-connector-java: allows unauthenticated attacker
with network access via multiple protocols to compromise MySQL Connectors which could
result in unauthorized update, insert or delete [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1851015
What |Removed |Added
----------------------------------------------------------------------------
Status|ON_QA |CLOSED
Resolution|--- |ERRATA
--
You are receiving this mail because:
You are on the CC list for the bug.
12:47 p.m.
New subject: [Bug 1851014] CVE-2020-2934 mysql-connector-java: allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors which could result in unauthorized update, insert or delete
https://bugzilla.redhat.com/show_bug.cgi?id=1851014
--- Comment #10 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> ---
This issue has been addressed in the following products:
RHDM 7.9.0
Via RHSA-2020:4960 https://access.redhat.com/errata/RHSA-2020:4960
--
You are receiving this mail because:
You are on the CC list for the bug.
12:47 p.m.
New subject: [Bug 1851014] CVE-2020-2934 mysql-connector-java: allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors which could result in unauthorized update, insert or delete
https://bugzilla.redhat.com/show_bug.cgi?id=1851014
errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Link ID| |Red Hat Product Errata
| |RHSA-2020:4960
--
You are receiving this mail because:
You are on the CC list for the bug.
12:49 p.m.
New subject: [Bug 1851014] CVE-2020-2934 mysql-connector-java: allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors which could result in unauthorized update, insert or delete
https://bugzilla.redhat.com/show_bug.cgi?id=1851014
--- Comment #11 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> ---
This issue has been addressed in the following products:
RHPAM 7.9.0
Via RHSA-2020:4961 https://access.redhat.com/errata/RHSA-2020:4961
--
You are receiving this mail because:
You are on the CC list for the bug.
12:49 p.m.
New subject: [Bug 1851014] CVE-2020-2934 mysql-connector-java: allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors which could result in unauthorized update, insert or delete
https://bugzilla.redhat.com/show_bug.cgi?id=1851014
errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Link ID| |Red Hat Product Errata
| |RHSA-2020:4961
--
You are receiving this mail because:
You are on the CC list for the bug.
2:21 p.m.
New subject: [Bug 1851014] CVE-2020-2934 mysql-connector-java: allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors which could result in unauthorized update, insert or delete
https://bugzilla.redhat.com/show_bug.cgi?id=1851014
Product Security DevOps Team <prodsec-dev(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |CLOSED
Resolution|--- |ERRATA
Last Closed| |2020-11-05 20:21:19
--- Comment #12 from Product Security DevOps Team <prodsec-dev(a)redhat.com> ---
This bug is now closed. Further updates for individual products will be
reflected on the CVE page(s):
https://access.redhat.com/security/cve/cve-2020-2934
--
You are receiving this mail because:
You are on the CC list for the bug.
3:32 p.m.
New subject: [Bug 1851014] CVE-2020-2934 mysql-connector-java: allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors which could result in unauthorized update, insert or delete
https://bugzilla.redhat.com/show_bug.cgi?id=1851014
--- Comment #13 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> ---
This issue has been addressed in the following products:
Red Hat Fuse 7.10
Via RHSA-2021:5134 https://access.redhat.com/errata/RHSA-2021:5134
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=1851014
3:32 p.m.
New subject: [Bug 1851014] CVE-2020-2934 mysql-connector-java: allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors which could result in unauthorized update, insert or delete
https://bugzilla.redhat.com/show_bug.cgi?id=1851014
errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Link ID| |Red Hat Product Errata
| |RHSA-2021:5134
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=1851014
889
days inactive
1426
days old
java-sig-commits@lists.fedoraproject.org
16 comments
1 participants
participants (1)
-
bugzilla＠redhat.com