A UNIX Symbolic Link (Symlink) Following vulnerability in the mysql-systemd-helper of the mariadb packaging of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15 allows local attackers to change the permissions of arbitrary files to 0640. This issue affects: SUSE Linux Enterprise Server 12 mariadb versions prior to 10.2.31-3.25.1. SUSE Linux Enterprise Server 15 mariadb versions prior to 10.2.31-3.26.1.

This update for mariadb fixes the following issues :

MariaDB was updated to version 10.2.31 GA (bsc#1162388).

Security issues fixed :

  - CVE-2020-2574: Fixed a difficult to exploit     vulnerability that allowed an attacker to crash the     client (bsc#1162388).

  - CVE-2019-18901: Fixed an unsafe path handling behavior     in mysql-systemd-helper (bsc#1160895).

  - Enabled security hardenings in MariaDB's systemd     service, namely ProtectSystem, ProtectHome and UMask     (bsc#1160878).

This update was imported from the SUSE:SLE-15:Update update project.

This update for mariadb fixes the following issues :

MariaDB was updated to version 10.2.31 GA (bsc#1162388).

Security issues fixed :

CVE-2020-2574: Fixed a difficult to exploit vulnerability that allowed an attacker to crash the client (bsc#1162388).

CVE-2019-18901: Fixed an unsafe path handling behavior in mysql-systemd-helper (bsc#1160895).

Enabled security hardenings in MariaDB's systemd service, namely ProtectSystem, ProtectHome and UMask (bsc#1160878).

Fixed a permissions issue in /var/lib/mysql (bsc#1077717).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for mariadb fixes the following issues :

MariaDB was updated to version 10.2.31 GA (bsc#1162388).

Security issues fixed :

CVE-2020-2574: Fixed a difficult to exploit vulnerability that allowed an attacker to crash the client (bsc#1162388).

CVE-2019-18901: Fixed an unsafe path handling behavior in mysql-systemd-helper (bsc#1160895).

Enabled security hardenings in MariaDB's systemd service, namely ProtectSystem, ProtectHome and UMask (bsc#1160878).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
134280	openSUSE Security Update : mariadb (openSUSE-2020-289)	Nessus	SuSE Local Security Checks	medium
134158	SUSE SLES12 Security Update : mariadb (SUSE-SU-2020:0505-1)	Nessus	SuSE Local Security Checks	medium
134105	SUSE SLED15 / SLES15 Security Update : mariadb (SUSE-SU-2020:0496-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2019-18901

medium

Tenable Plugins

medium

medium

medium