Linux · Security advisory · September 14, 2020

RHSA-2020:3732: Security update for 10 packages

RHSA-2020:3732, released September 14, 2020, fixes 109 CVEs across 10 products. None of them is reported as exploited. Patch Radar priority: High.

High

CVEs closed

109

None rated Critical

Exploited

None reported

Exploitation more likely

Vendor assessment

Highest EPSS

0.0376

89th percentile

Priority of the 109 CVEs

Patch now 0
                                Urgent 0
                                High 4
                                Routine 105

Fixed package versions

Product	Release	Fixed in
mecab	RHEL 8	0:0.996-1.module+el8.0.0+3898+e09bb8de.9
mecab-ipadic	RHEL 8	0:2.7.0.20070801-16.module+el8.0.0+3898+e09bb8de
mecab-ipadic-EUCJP	RHEL 8	0:2.7.0.20070801-16.module+el8.0.0+3898+e09bb8de
mysql	RHEL 8	0:8.0.21-1.module+el8.2.0+7855+47abd494
mysql-common	RHEL 8	0:8.0.21-1.module+el8.2.0+7855+47abd494
mysql-devel	RHEL 8	0:8.0.21-1.module+el8.2.0+7855+47abd494
mysql-errmsg	RHEL 8	0:8.0.21-1.module+el8.2.0+7855+47abd494
mysql-libs	RHEL 8	0:8.0.21-1.module+el8.2.0+7855+47abd494
mysql-server	RHEL 8	0:8.0.21-1.module+el8.2.0+7855+47abd494
mysql-test	RHEL 8	0:8.0.21-1.module+el8.2.0+7855+47abd494

CVEs this fix closes

Priority	CVE	Title	CVSS	EPSS	Exploitation
High	CVE-2020-14663	mysql-router: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: Security: Privileges)	7.2	0.0212	None reported
High	CVE-2020-14678	libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: Security: Privileges)	7.2	0.0204	None reported
High	CVE-2020-14697	libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: Security: Privileges)	7.2	0.0204	None reported
High	CVE-2021-2144	mecab: MySQL is a multi-user, multi-threaded SQL database server	7.2	0.0189	None reported
Routine	CVE-2019-2974	libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: Optimizer)	6.5	0.0376	None reported
Routine	CVE-2020-2574	libmysqlclient21: Vulnerability in the MySQL Client product of Oracle MySQL (component: CAPI)	5.9	0.0351	None reported
Routine	CVE-2020-2804	libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: Memcached)	5.9	0.0339	None reported
Routine	CVE-2020-2760	libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:InnoDB)	5.5	0.0301	None reported
Routine	CVE-2020-2573	libmysqlclient21: Vulnerability in the MySQL Client product of Oracle MySQL (component: CAPI)	5.9	0.0301	None reported
Routine	CVE-2020-2812	libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: Stored Procedure)	4.9	0.0301	None reported
Routine	CVE-2019-2938	libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:InnoDB)	4.4	0.0299	None reported
Routine	CVE-2021-2020	mecab: MySQL is a multi-user, multi-threaded SQL database server	6.5	0.0298	None reported
Routine	CVE-2020-2570	mysql-client: Vulnerability in the MySQL Client product of Oracle MySQL (component: CAPI)	5.9	0.0292	None reported
Routine	CVE-2020-2814	libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:InnoDB)	4.9	0.0281	None reported
Routine	CVE-2019-2946	libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: PS)	6.5	0.0269	None reported
Routine	CVE-2020-14619	libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: Parser)	6.5	0.0269	None reported
Routine	CVE-2019-2966	mecab: MySQL is a multi-user, multi-threaded SQL database server	6.5	0.0265	None reported
Routine	CVE-2019-2967	mecab: MySQL is a multi-user, multi-threaded SQL database server	6.5	0.0265	None reported
Routine	CVE-2019-3004	mecab: MySQL is a multi-user, multi-threaded SQL database server	6.5	0.0265	None reported
Routine	CVE-2019-3011	mecab: MySQL is a multi-user, multi-threaded SQL database server	6.5	0.0265	None reported
Routine	CVE-2019-2960	libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: Replication)	4.9	0.0259	None reported
Routine	CVE-2019-2963	mecab: MySQL is a multi-user, multi-threaded SQL database server	4.9	0.0256	None reported
Routine	CVE-2019-2968	mecab: MySQL is a multi-user, multi-threaded SQL database server	4.9	0.0256	None reported
Routine	CVE-2019-2982	mecab: MySQL is a multi-user, multi-threaded SQL database server	4.9	0.0256	None reported
Routine	CVE-2019-2997	mecab: MySQL is a multi-user, multi-threaded SQL database server	4.9	0.0256	None reported

Also fixes CVE-2020-14663

ELSA-2020-3732
mecab, mecab-ipadic, mecab-ipadic-EUCJP and 7 more on ol 8
libmysqlclient21 8.0.21-0ubuntu0.20.04.3
libmysqlclient21 on Ubuntu 20.04 LTS (focal)
mysql-client 8.0.21-0ubuntu0.20.04.3
mysql-client on Ubuntu 20.04 LTS (focal)
mysql-client-8.0 8.0.21-0ubuntu0.20.04.3
mysql-client-8.0 on Ubuntu 20.04 LTS (focal)
mysql-client-core-8.0 8.0.21-0ubuntu0.20.04.3
mysql-client-core-8.0 on Ubuntu 20.04 LTS (focal)
mysql-router 8.0.21-0ubuntu0.20.04.3
mysql-router on Ubuntu 20.04 LTS (focal)
mysql-server 8.0.21-0ubuntu0.20.04.3
mysql-server on Ubuntu 20.04 LTS (focal)
mysql-server-8.0 8.0.21-0ubuntu0.20.04.3
mysql-server-8.0 on Ubuntu 20.04 LTS (focal)

Vendor advisory

https://access.redhat.com/errata/RHSA-2020:3732

For tools and AI agents

This page as data: JSON · Markdown

Which servers are still behind?

Patchblox compares the installed package on every Linux machine against the fixed version for its release, including machines reported through Azure Update Manager.

Get a demo