galera: MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL
CVE-2020-13249 is fixed in 45 products on 1 platform, first by RHSA-2020:5500, released December 15, 2020. It is not reported as exploited. Patch Radar priority: High.
MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL. The following packages have been upgraded to a later upstream version: mariadb (10.3.27), galera (25.3.31). (BZ#1899082, BZ#1899086) Security Fix(es): * mariadb: Insufficient SST method name check leading to code injection in mysql-wsrep (CVE-2020-15180) * mysql: InnoDB unspecified vulnerability (CPU Oct 2019) (CVE-2019-2938) * mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2019) (CVE-2019-2974) * mysql: C API unspecified vulnerability (CPU Apr 2020) (CVE-2020-2752) * mysql: InnoDB unspecified vulnerability (CPU Apr 2020) (CVE-2020-2760) * mysql: Server: DML unspecified vulnerability (CPU Apr 2020) (CVE-2020-2780) * mysql: Server: Stored Procedure unspecified vulnerability (CPU Apr 2020) (CVE-2020-2812) * mysql: InnoDB unspecified vulnerability (CPU Apr 2020) (CVE-2020-2814) * mariadb-connector-c: Improper validation of content in a OK packet received from server (CVE-2020-13249) * mysql: Server: FTS unspecified vulnerability (CPU Oct 2020) (CVE-2020-14765) * mysql: InnoDB unspecified vulnerability (CPU Oct 2020) (CVE-2020-14776) * mysql: Server: FTS unspecified vulnerability (CPU Oct 2020) (CVE-2020-14789) * mysql: Server: Locking unspecified vulnerability (CPU Oct 2020) (CVE-2020-14812) * mysql: C API unspecified vulnerability (CPU Jan 2020) (CVE-2020-2574) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * FTBFS: -D_GLIBCXX_ASSERTIONS (BZ#1899009) * Queries with entity_id IN ('1', '2', …, '70000') run much slower in MariaDB 10.3 than on MariaDB 10.1 (BZ#1899017) * Cleanup race with wsrep_rsync_sst_tunnel may prevent full galera cluster bootstrap (BZ#1899021) * There are undeclared file conflicts in several mariadb and mysql packages (BZ#1899077)
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| Judy · RHEL 8 | 0:1.0.5-18.module+el8+2765+cfa4f87b | RHSA-2020:5500 | Dec 15, 2020 |
| Judy · ol 8 | 0:1.0.5-18.module+el8.1.0+5402+691bd77e | ELSA-2020-5500 | Dec 18, 2020 |
| Judy-devel · ol 8 | 0:1.0.5-18.module+el8.1.0+5402+691bd77e | ELSA-2020-5500 | Dec 18, 2020 |
| asio-devel · ol 8 | 0:1.10.8-7.module+el8.1.0+5402+691bd77e | ELSA-2020-5500 | Dec 18, 2020 |
| galera · RHEL 8 | 0:25.3.31-1.module+el8.3.0+8843+3f4e42f6 | RHSA-2020:5500 | Dec 15, 2020 |
| galera · ol 8 | 0:25.3.31-1.module+el8.3.0+7885+7a81225f | ELSA-2020-5500 | Dec 18, 2020 |
| libmariadb-dev-compat · Ubuntu 20.04 LTS (focal) | 1:10.3.25-0ubuntu0.20.04.1 | libmariadb-dev-compat 1:10.3.25-0ubuntu0.20.04.1 | May 27, 2021 |
| libmariadb3 · Ubuntu 20.04 LTS (focal) | 1:10.3.25-0ubuntu0.20.04.1 | libmariadb3 1:10.3.25-0ubuntu0.20.04.1 | May 27, 2021 |
| libmariadbclient-dev-compat · Ubuntu 18.04.6 LTS (bionic) | 1:10.1.47-0ubuntu0.18.04.1 | libmariadbclient-dev-compat 1:10.1.47-0ubuntu0.18.04.1 | May 27, 2021 |
| libmariadbclient18 · Ubuntu 18.04.6 LTS (bionic) | 1:10.1.47-0ubuntu0.18.04.1 | libmariadbclient18 1:10.1.47-0ubuntu0.18.04.1 | May 27, 2021 |
| libmariadbd18 · Ubuntu 18.04.6 LTS (bionic) | 1:10.1.47-0ubuntu0.18.04.1 | libmariadbd18 1:10.1.47-0ubuntu0.18.04.1 | May 27, 2021 |
| libmariadbd19 · Ubuntu 20.04 LTS (focal) | 1:10.3.25-0ubuntu0.20.04.1 | libmariadbd19 1:10.3.25-0ubuntu0.20.04.1 | May 27, 2021 |
| mariadb · RHEL 8 | 3:10.3.27-3.module+el8.3.0+8972+5e3224e9 | RHSA-2020:5500 | Dec 15, 2020 |
| mariadb · ol 8 | 3:10.3.27-3.module+el8.3.0+7885+7a81225f | ELSA-2020-5500 | Dec 18, 2020 |
| mariadb-backup · RHEL 8 | 3:10.3.27-3.module+el8.3.0+8972+5e3224e9 | RHSA-2020:5500 | Dec 15, 2020 |
| mariadb-backup · Ubuntu 20.04 LTS (focal) | 1:10.3.25-0ubuntu0.20.04.1 | mariadb-backup 1:10.3.25-0ubuntu0.20.04.1 | May 27, 2021 |
| mariadb-backup · ol 8 | 3:10.3.27-3.module+el8.3.0+7885+7a81225f | ELSA-2020-5500 | Dec 18, 2020 |
| mariadb-client · Ubuntu 18.04.6 LTS (bionic) | 1:10.1.47-0ubuntu0.18.04.1 | mariadb-client 1:10.1.47-0ubuntu0.18.04.1 | May 27, 2021 |
| mariadb-client · Ubuntu 20.04 LTS (focal) | 1:10.3.25-0ubuntu0.20.04.1 | mariadb-client 1:10.3.25-0ubuntu0.20.04.1 | May 27, 2021 |
| mariadb-client-10.1 · Ubuntu 18.04.6 LTS (bionic) | 1:10.1.47-0ubuntu0.18.04.1 | mariadb-client-10.1 1:10.1.47-0ubuntu0.18.04.1 | May 27, 2021 |
| mariadb-client-10.3 · Ubuntu 20.04 LTS (focal) | 1:10.3.25-0ubuntu0.20.04.1 | mariadb-client-10.3 1:10.3.25-0ubuntu0.20.04.1 | May 27, 2021 |
| mariadb-client-core-10.1 · Ubuntu 18.04.6 LTS (bionic) | 1:10.1.47-0ubuntu0.18.04.1 | mariadb-client-core-10.1 1:10.1.47-0ubuntu0.18.04.1 | May 27, 2021 |
| mariadb-client-core-10.3 · Ubuntu 20.04 LTS (focal) | 1:10.3.25-0ubuntu0.20.04.1 | mariadb-client-core-10.3 1:10.3.25-0ubuntu0.20.04.1 | May 27, 2021 |
| mariadb-common · RHEL 8 | 3:10.3.27-3.module+el8.3.0+8972+5e3224e9 | RHSA-2020:5500 | Dec 15, 2020 |
| mariadb-common · Ubuntu 18.04.6 LTS (bionic) | 1:10.1.47-0ubuntu0.18.04.1 | mariadb-common 1:10.1.47-0ubuntu0.18.04.1 | May 27, 2021 |
| mariadb-common · Ubuntu 20.04 LTS (focal) | 1:10.3.25-0ubuntu0.20.04.1 | mariadb-common 1:10.3.25-0ubuntu0.20.04.1 | May 27, 2021 |
| mariadb-common · ol 8 | 3:10.3.27-3.module+el8.3.0+7885+7a81225f | ELSA-2020-5500 | Dec 18, 2020 |
| mariadb-connector-c · RHEL 8 | 0:3.1.11-2.el8_3 | RHSA-2020:5503 | Dec 15, 2020 |
| mariadb-connector-c · ol 8 | 0:3.1.11-2.el8_3 | ELSA-2020-5503-1 | Dec 18, 2020 |
| mariadb-connector-c-config · RHEL 8 | 0:3.1.11-2.el8_3 | RHSA-2020:5503 | Dec 15, 2020 |
| mariadb-connector-c-config · ol 8 | 0:3.1.11-2.el8_3 | ELSA-2020-5503-1 | Dec 18, 2020 |
| mariadb-connector-c-devel · RHEL 8 | 0:3.1.11-2.el8_3 | RHSA-2020:5503 | Dec 15, 2020 |
| mariadb-connector-c-devel · ol 8 | 0:3.1.11-2.el8_3 | ELSA-2020-5503-1 | Dec 18, 2020 |
| mariadb-devel · RHEL 8 | 3:10.3.27-3.module+el8.3.0+8972+5e3224e9 | RHSA-2020:5500 | Dec 15, 2020 |
| mariadb-devel · ol 8 | 3:10.3.27-3.module+el8.3.0+7885+7a81225f | ELSA-2020-5500 | Dec 18, 2020 |
| mariadb-embedded · RHEL 8 | 3:10.3.27-3.module+el8.3.0+8972+5e3224e9 | RHSA-2020:5500 | Dec 15, 2020 |
| mariadb-embedded · ol 8 | 3:10.3.27-3.module+el8.3.0+7885+7a81225f | ELSA-2020-5500 | Dec 18, 2020 |
| mariadb-embedded-devel · RHEL 8 | 3:10.3.27-3.module+el8.3.0+8972+5e3224e9 | RHSA-2020:5500 | Dec 15, 2020 |
| mariadb-embedded-devel · ol 8 | 3:10.3.27-3.module+el8.3.0+7885+7a81225f | ELSA-2020-5500 | Dec 18, 2020 |
| mariadb-errmsg · RHEL 8 | 3:10.3.27-3.module+el8.3.0+8972+5e3224e9 | RHSA-2020:5500 | Dec 15, 2020 |
| mariadb-errmsg · ol 8 | 3:10.3.27-3.module+el8.3.0+7885+7a81225f | ELSA-2020-5500 | Dec 18, 2020 |
| mariadb-gssapi-server · RHEL 8 | 3:10.3.27-3.module+el8.3.0+8972+5e3224e9 | RHSA-2020:5500 | Dec 15, 2020 |
| mariadb-gssapi-server · ol 8 | 3:10.3.27-3.module+el8.3.0+7885+7a81225f | ELSA-2020-5500 | Dec 18, 2020 |
| mariadb-oqgraph-engine · RHEL 8 | 3:10.3.27-3.module+el8.3.0+8972+5e3224e9 | RHSA-2020:5500 | Dec 15, 2020 |
| mariadb-oqgraph-engine · ol 8 | 3:10.3.27-3.module+el8.3.0+7885+7a81225f | ELSA-2020-5500 | Dec 18, 2020 |
| mariadb-plugin-connect · Ubuntu 18.04.6 LTS (bionic) | 1:10.1.47-0ubuntu0.18.04.1 | mariadb-plugin-connect 1:10.1.47-0ubuntu0.18.04.1 | May 27, 2021 |
| mariadb-plugin-connect · Ubuntu 20.04 LTS (focal) | 1:10.3.25-0ubuntu0.20.04.1 | mariadb-plugin-connect 1:10.3.25-0ubuntu0.20.04.1 | May 27, 2021 |
| mariadb-plugin-cracklib-password-check · Ubuntu 18.04.6 LTS (bionic) | 1:10.1.47-0ubuntu0.18.04.1 | mariadb-plugin-cracklib-password-check 1:10.1.47-0ubuntu0.18.04.1 | May 27, 2021 |
| mariadb-plugin-cracklib-password-check · Ubuntu 20.04 LTS (focal) | 1:10.3.25-0ubuntu0.20.04.1 | mariadb-plugin-cracklib-password-check 1:10.3.25-0ubuntu0.20.04.1 | May 27, 2021 |
| mariadb-plugin-gssapi-client · Ubuntu 18.04.6 LTS (bionic) | 1:10.1.47-0ubuntu0.18.04.1 | mariadb-plugin-gssapi-client 1:10.1.47-0ubuntu0.18.04.1 | May 27, 2021 |
| mariadb-plugin-gssapi-client · Ubuntu 20.04 LTS (focal) | 1:10.3.25-0ubuntu0.20.04.1 | mariadb-plugin-gssapi-client 1:10.3.25-0ubuntu0.20.04.1 | May 27, 2021 |
| mariadb-plugin-gssapi-server · Ubuntu 18.04.6 LTS (bionic) | 1:10.1.47-0ubuntu0.18.04.1 | mariadb-plugin-gssapi-server 1:10.1.47-0ubuntu0.18.04.1 | May 27, 2021 |
| mariadb-plugin-gssapi-server · Ubuntu 20.04 LTS (focal) | 1:10.3.25-0ubuntu0.20.04.1 | mariadb-plugin-gssapi-server 1:10.3.25-0ubuntu0.20.04.1 | May 27, 2021 |
| mariadb-plugin-mroonga · Ubuntu 18.04.6 LTS (bionic) | 1:10.1.47-0ubuntu0.18.04.1 | mariadb-plugin-mroonga 1:10.1.47-0ubuntu0.18.04.1 | May 27, 2021 |
| mariadb-plugin-mroonga · Ubuntu 20.04 LTS (focal) | 1:10.3.25-0ubuntu0.20.04.1 | mariadb-plugin-mroonga 1:10.3.25-0ubuntu0.20.04.1 | May 27, 2021 |
| mariadb-plugin-oqgraph · Ubuntu 18.04.6 LTS (bionic) | 1:10.1.47-0ubuntu0.18.04.1 | mariadb-plugin-oqgraph 1:10.1.47-0ubuntu0.18.04.1 | May 27, 2021 |
| mariadb-plugin-oqgraph · Ubuntu 20.04 LTS (focal) | 1:10.3.25-0ubuntu0.20.04.1 | mariadb-plugin-oqgraph 1:10.3.25-0ubuntu0.20.04.1 | May 27, 2021 |
| mariadb-plugin-rocksdb · Ubuntu 20.04 LTS (focal) | 1:10.3.25-0ubuntu0.20.04.1 | mariadb-plugin-rocksdb 1:10.3.25-0ubuntu0.20.04.1 | May 27, 2021 |
| mariadb-plugin-spider · Ubuntu 18.04.6 LTS (bionic) | 1:10.1.47-0ubuntu0.18.04.1 | mariadb-plugin-spider 1:10.1.47-0ubuntu0.18.04.1 | May 27, 2021 |
| mariadb-plugin-spider · Ubuntu 20.04 LTS (focal) | 1:10.3.25-0ubuntu0.20.04.1 | mariadb-plugin-spider 1:10.3.25-0ubuntu0.20.04.1 | May 27, 2021 |
| mariadb-plugin-tokudb · Ubuntu 18.04.6 LTS (bionic) | 1:10.1.47-0ubuntu0.18.04.1 | mariadb-plugin-tokudb 1:10.1.47-0ubuntu0.18.04.1 | May 27, 2021 |
| mariadb-plugin-tokudb · Ubuntu 20.04 LTS (focal) | 1:10.3.25-0ubuntu0.20.04.1 | mariadb-plugin-tokudb 1:10.3.25-0ubuntu0.20.04.1 | May 27, 2021 |
| mariadb-server · RHEL 8 | 3:10.3.27-3.module+el8.3.0+8972+5e3224e9 | RHSA-2020:5500 | Dec 15, 2020 |
| mariadb-server · Ubuntu 18.04.6 LTS (bionic) | 1:10.1.47-0ubuntu0.18.04.1 | mariadb-server 1:10.1.47-0ubuntu0.18.04.1 | May 27, 2021 |
| mariadb-server · Ubuntu 20.04 LTS (focal) | 1:10.3.25-0ubuntu0.20.04.1 | mariadb-server 1:10.3.25-0ubuntu0.20.04.1 | May 27, 2021 |
| mariadb-server · ol 8 | 3:10.3.27-3.module+el8.3.0+7885+7a81225f | ELSA-2020-5500 | Dec 18, 2020 |
| mariadb-server-10.1 · Ubuntu 18.04.6 LTS (bionic) | 1:10.1.47-0ubuntu0.18.04.1 | mariadb-server-10.1 1:10.1.47-0ubuntu0.18.04.1 | May 27, 2021 |
| mariadb-server-10.3 · Ubuntu 20.04 LTS (focal) | 1:10.3.25-0ubuntu0.20.04.1 | mariadb-server-10.3 1:10.3.25-0ubuntu0.20.04.1 | May 27, 2021 |
| mariadb-server-core-10.1 · Ubuntu 18.04.6 LTS (bionic) | 1:10.1.47-0ubuntu0.18.04.1 | mariadb-server-core-10.1 1:10.1.47-0ubuntu0.18.04.1 | May 27, 2021 |
| mariadb-server-core-10.3 · Ubuntu 20.04 LTS (focal) | 1:10.3.25-0ubuntu0.20.04.1 | mariadb-server-core-10.3 1:10.3.25-0ubuntu0.20.04.1 | May 27, 2021 |
| mariadb-server-galera · RHEL 8 | 3:10.3.27-3.module+el8.3.0+8972+5e3224e9 | RHSA-2020:5500 | Dec 15, 2020 |
| mariadb-server-galera · ol 8 | 3:10.3.27-3.module+el8.3.0+7885+7a81225f | ELSA-2020-5500 | Dec 18, 2020 |
| mariadb-server-utils · RHEL 8 | 3:10.3.27-3.module+el8.3.0+8972+5e3224e9 | RHSA-2020:5500 | Dec 15, 2020 |
| mariadb-server-utils · ol 8 | 3:10.3.27-3.module+el8.3.0+7885+7a81225f | ELSA-2020-5500 | Dec 18, 2020 |
| mariadb-test · RHEL 8 | 3:10.3.27-3.module+el8.3.0+8972+5e3224e9 | RHSA-2020:5500 | Dec 15, 2020 |
| mariadb-test · Ubuntu 18.04.6 LTS (bionic) | 1:10.1.47-0ubuntu0.18.04.1 | mariadb-test 1:10.1.47-0ubuntu0.18.04.1 | May 27, 2021 |
| mariadb-test · Ubuntu 20.04 LTS (focal) | 1:10.3.25-0ubuntu0.20.04.1 | mariadb-test 1:10.3.25-0ubuntu0.20.04.1 | May 27, 2021 |
| mariadb-test · ol 8 | 3:10.3.27-3.module+el8.3.0+7885+7a81225f | ELSA-2020-5500 | Dec 18, 2020 |
| mariadb-test-data · Ubuntu 18.04.6 LTS (bionic) | 1:10.1.47-0ubuntu0.18.04.1 | mariadb-test-data 1:10.1.47-0ubuntu0.18.04.1 | May 27, 2021 |
| mariadb-test-data · Ubuntu 20.04 LTS (focal) | 1:10.3.25-0ubuntu0.20.04.1 | mariadb-test-data 1:10.3.25-0ubuntu0.20.04.1 | May 27, 2021 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.