Linux · Security advisory · September 16, 2020

ELSA-2020-3732: Security update for 10 packages

ELSA-2020-3732, released September 16, 2020, fixes 98 CVEs across 10 products. None of them is reported as exploited. Patch Radar priority: High.

High

CVEs closed

None rated Critical

Exploited

None reported

Exploitation more likely

Vendor assessment

Highest EPSS

0.0376

89th percentile

Priority of the 98 CVEs

Patch now 0
                                Urgent 0
                                High 3
                                Routine 95

Fixed package versions

Product	Release	Fixed in
mecab	ol 8	0:0.996-1.module+el8.0.0+5253+1dce7bb2.9
mecab-ipadic	ol 8	0:2.7.0.20070801-16.0.1.module+el8.0.0+5253+1dce7bb2
mecab-ipadic-EUCJP	ol 8	0:2.7.0.20070801-16.0.1.module+el8.0.0+5253+1dce7bb2
mysql	ol 8	0:8.0.21-1.module+el8.2.0+7793+cfe2b687
mysql-common	ol 8	0:8.0.21-1.module+el8.2.0+7793+cfe2b687
mysql-devel	ol 8	0:8.0.21-1.module+el8.2.0+7793+cfe2b687
mysql-errmsg	ol 8	0:8.0.21-1.module+el8.2.0+7793+cfe2b687
mysql-libs	ol 8	0:8.0.21-1.module+el8.2.0+7793+cfe2b687
mysql-server	ol 8	0:8.0.21-1.module+el8.2.0+7793+cfe2b687
mysql-test	ol 8	0:8.0.21-1.module+el8.2.0+7793+cfe2b687

CVEs this fix closes

Priority	CVE	Title	CVSS	EPSS	Exploitation
High	CVE-2020-14663	mysql-router: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: Security: Privileges)	7.2	0.0212	None reported
High	CVE-2020-14678	libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: Security: Privileges)	7.2	0.0204	None reported
High	CVE-2020-14697	libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: Security: Privileges)	7.2	0.0204	None reported
Routine	CVE-2019-2974	libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: Optimizer)	6.5	0.0376	None reported
Routine	CVE-2020-2574	libmysqlclient21: Vulnerability in the MySQL Client product of Oracle MySQL (component: CAPI)	5.9	0.0351	None reported
Routine	CVE-2020-2804	libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: Memcached)	5.9	0.0339	None reported
Routine	CVE-2020-2760	libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:InnoDB)	5.5	0.0301	None reported
Routine	CVE-2020-2573	libmysqlclient21: Vulnerability in the MySQL Client product of Oracle MySQL (component: CAPI)	5.9	0.0301	None reported
Routine	CVE-2020-2812	libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: Stored Procedure)	4.9	0.0301	None reported
Routine	CVE-2019-2938	libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:InnoDB)	4.4	0.0299	None reported
Routine	CVE-2020-2570	mysql-client: Vulnerability in the MySQL Client product of Oracle MySQL (component: CAPI)	5.9	0.0292	None reported
Routine	CVE-2020-2814	libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:InnoDB)	4.9	0.0281	None reported
Routine	CVE-2019-2946	libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: PS)	6.5	0.0269	None reported
Routine	CVE-2020-14619	libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: Parser)	6.5	0.0269	None reported
Routine	CVE-2019-2966	mecab: MySQL is a multi-user, multi-threaded SQL database server	6.5	0.0265	None reported
Routine	CVE-2019-2967	mecab: MySQL is a multi-user, multi-threaded SQL database server	6.5	0.0265	None reported
Routine	CVE-2019-3004	mecab: MySQL is a multi-user, multi-threaded SQL database server	6.5	0.0265	None reported
Routine	CVE-2019-3011	mecab: MySQL is a multi-user, multi-threaded SQL database server	6.5	0.0265	None reported
Routine	CVE-2019-2960	libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: Replication)	4.9	0.0259	None reported
Routine	CVE-2019-2963	mecab: MySQL is a multi-user, multi-threaded SQL database server	4.9	0.0256	None reported
Routine	CVE-2019-2968	mecab: MySQL is a multi-user, multi-threaded SQL database server	4.9	0.0256	None reported
Routine	CVE-2019-2982	mecab: MySQL is a multi-user, multi-threaded SQL database server	4.9	0.0256	None reported
Routine	CVE-2019-2997	mecab: MySQL is a multi-user, multi-threaded SQL database server	4.9	0.0256	None reported
Routine	CVE-2019-2998	mecab: MySQL is a multi-user, multi-threaded SQL database server	4.9	0.0256	None reported
Routine	CVE-2020-14547	libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: Optimizer)	4.9	0.0254	None reported

Also fixes CVE-2020-14663

RHSA-2020:3732
mecab, mecab-ipadic, mecab-ipadic-EUCJP and 7 more on RHEL 8
libmysqlclient21 8.0.21-0ubuntu0.20.04.3
libmysqlclient21 on Ubuntu 20.04 LTS (focal)
mysql-client 8.0.21-0ubuntu0.20.04.3
mysql-client on Ubuntu 20.04 LTS (focal)
mysql-client-8.0 8.0.21-0ubuntu0.20.04.3
mysql-client-8.0 on Ubuntu 20.04 LTS (focal)
mysql-client-core-8.0 8.0.21-0ubuntu0.20.04.3
mysql-client-core-8.0 on Ubuntu 20.04 LTS (focal)
mysql-router 8.0.21-0ubuntu0.20.04.3
mysql-router on Ubuntu 20.04 LTS (focal)
mysql-server 8.0.21-0ubuntu0.20.04.3
mysql-server on Ubuntu 20.04 LTS (focal)
mysql-server-8.0 8.0.21-0ubuntu0.20.04.3
mysql-server-8.0 on Ubuntu 20.04 LTS (focal)

Vendor advisory

https://linux.oracle.com/errata/ELSA-2020-3732.html

For tools and AI agents

This page as data: JSON · Markdown

Which servers are still behind?

Patchblox compares the installed package on every Linux machine against the fixed version for its release, including machines reported through Azure Update Manager.

Get a demo