Linux · Security advisory · December 15, 2020

RHSA-2020:5500: Security update for 15 packages

RHSA-2020:5500, released December 15, 2020, fixes 17 CVEs across 15 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
17
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0554
92nd percentile

Priority of the 17 CVEs

Patch now 0 Urgent 0 High 3 Routine 14

Fixed package versions

ProductReleaseFixed in
JudyRHEL 80:1.0.5-18.module+el8+2765+cfa4f87b
galeraRHEL 80:25.3.31-1.module+el8.3.0+8843+3f4e42f6
mariadbRHEL 83:10.3.27-3.module+el8.3.0+8972+5e3224e9
mariadb-backupRHEL 83:10.3.27-3.module+el8.3.0+8972+5e3224e9
mariadb-commonRHEL 83:10.3.27-3.module+el8.3.0+8972+5e3224e9
mariadb-develRHEL 83:10.3.27-3.module+el8.3.0+8972+5e3224e9
mariadb-embeddedRHEL 83:10.3.27-3.module+el8.3.0+8972+5e3224e9
mariadb-embedded-develRHEL 83:10.3.27-3.module+el8.3.0+8972+5e3224e9
mariadb-errmsgRHEL 83:10.3.27-3.module+el8.3.0+8972+5e3224e9
mariadb-gssapi-serverRHEL 83:10.3.27-3.module+el8.3.0+8972+5e3224e9
mariadb-oqgraph-engineRHEL 83:10.3.27-3.module+el8.3.0+8972+5e3224e9
mariadb-serverRHEL 83:10.3.27-3.module+el8.3.0+8972+5e3224e9
mariadb-server-galeraRHEL 83:10.3.27-3.module+el8.3.0+8972+5e3224e9
mariadb-server-utilsRHEL 83:10.3.27-3.module+el8.3.0+8972+5e3224e9
mariadb-testRHEL 83:10.3.27-3.module+el8.3.0+8972+5e3224e9

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
High CVE-2020-15180 galera: MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL 9.0 0.0554 None reported
High CVE-2020-13249 galera: MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL 8.8 0.0240 None reported
High CVE-2021-2144 mecab: MySQL is a multi-user, multi-threaded SQL database server 7.2 0.0189 None reported
Routine CVE-2019-2974 libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: Optimizer) 6.5 0.0376 None reported
Routine CVE-2020-2574 libmysqlclient21: Vulnerability in the MySQL Client product of Oracle MySQL (component: CAPI) 5.9 0.0351 None reported
Routine CVE-2020-14765 libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: FTS) 6.5 0.0317 None reported
Routine CVE-2020-2760 libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:InnoDB) 5.5 0.0301 None reported
Routine CVE-2020-2812 libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: Stored Procedure) 4.9 0.0301 None reported
Routine CVE-2019-2938 libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:InnoDB) 4.4 0.0299 None reported
Routine CVE-2020-14812 libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: Locking) 4.9 0.0292 None reported
Routine CVE-2020-2814 libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:InnoDB) 4.9 0.0281 None reported
Routine CVE-2020-14776 libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:InnoDB) 4.9 0.0265 None reported
Routine CVE-2020-14789 libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: FTS) 4.9 0.0265 None reported
Routine CVE-2020-2780 libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: DML) 6.5 0.0245 None reported
Routine CVE-2020-2752 mecab: MySQL is a multi-user, multi-threaded SQL database server 5.3 0.0234 None reported
Routine CVE-2021-2194 libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:InnoDB) 4.9 0.0231 None reported
Routine CVE-2021-2022 mysql-router: Vulnerability in the MySQL Server product of Oracle MySQL (component:InnoDB) 4.4 0.0192 None reported
Showing 1 to 17 of 17 1