Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser). Supported versions that are affected are 5.7.29 and prior and 8.0.19 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in takeover of MySQL Server. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2020:5500 advisory.

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are     affected are 5.7.27 and prior and 8.0.17 and prior. Difficult to exploit vulnerability allows high     privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful     attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable     crash (complete DOS) of MySQL Server. (CVE-2019-2938)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported     versions that are affected are 5.6.45 and prior, 5.7.27 and prior and 8.0.17 and prior. Easily exploitable     vulnerability allows low privileged attacker with network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang     or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2019-2974)

  - libmariadb/mariadb_lib.c in MariaDB Connector/C before 3.1.8 does not properly validate the content of an     OK packet received from a server. NOTE: although mariadb_lib.c was originally based on code shipped for     MySQL, this issue does not affect any MySQL components supported by Oracle. (CVE-2020-13249)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: FTS). Supported versions     that are affected are 5.6.49 and prior, 5.7.31 and prior and 8.0.21 and prior. Easily exploitable     vulnerability allows low privileged attacker with network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang     or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2020-14765)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are     affected are 5.7.31 and prior and 8.0.21 and prior. Easily exploitable vulnerability allows high     privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful     attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable     crash (complete DOS) of MySQL Server. (CVE-2020-14776)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: FTS). Supported versions     that are affected are 5.7.31 and prior and 8.0.21 and prior. Easily exploitable vulnerability allows high     privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful     attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable     crash (complete DOS) of MySQL Server. (CVE-2020-14789)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Locking). Supported versions     that are affected are 5.6.49 and prior, 5.7.31 and prior and 8.0.21 and prior. Easily exploitable     vulnerability allows high privileged attacker with network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang     or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2020-14812)

  - A flaw was found in the mysql-wsrep component of mariadb. Lack of input sanitization in `wsrep_sst_method`     allows for command injection that can be exploited by a remote attacker to execute arbitrary commands on     galera cluster nodes. This threatens the system's confidentiality, integrity, and availability. This flaw     affects mariadb versions before 10.1.47, before 10.2.34, before 10.3.25, before 10.4.15 and before 10.5.6.
    (CVE-2020-15180)

  - Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are     affected are 5.6.46 and prior, 5.7.28 and prior and 8.0.18 and prior. Difficult to exploit vulnerability     allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Client.
    Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently     repeatable crash (complete DOS) of MySQL Client. (CVE-2020-2574)

  - Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are     affected are 5.6.47 and prior, 5.7.27 and prior and 8.0.17 and prior. Difficult to exploit vulnerability     allows low privileged attacker with network access via multiple protocols to compromise MySQL Client.
    Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently     repeatable crash (complete DOS) of MySQL Client. (CVE-2020-2752)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are     affected are 5.7.29 and prior and 8.0.19 and prior. Easily exploitable vulnerability allows high     privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful     attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable     crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of     MySQL Server accessible data. (CVE-2020-2760)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions     that are affected are 5.6.47 and prior, 5.7.29 and prior and 8.0.19 and prior. Easily exploitable     vulnerability allows low privileged attacker with network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang     or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2020-2780)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure). Supported     versions that are affected are 5.6.47 and prior, 5.7.29 and prior and 8.0.19 and prior. Easily exploitable     vulnerability allows high privileged attacker with network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang     or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2020-2812)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are     affected are 5.6.47 and prior, 5.7.28 and prior and 8.0.18 and prior. Easily exploitable vulnerability     allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.
    Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently     repeatable crash (complete DOS) of MySQL Server. (CVE-2020-2814)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are     affected are 5.6.50 and prior, 5.7.32 and prior and 8.0.22 and prior. Difficult to exploit vulnerability     allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.
    Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently     repeatable crash (complete DOS) of MySQL Server. (CVE-2021-2022)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser). Supported versions     that are affected are 5.7.29 and prior and 8.0.19 and prior. Easily exploitable vulnerability allows high     privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful     attacks of this vulnerability can result in takeover of MySQL Server. (CVE-2021-2144)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are     affected are 5.7.33 and prior and 8.0.23 and prior. Easily exploitable vulnerability allows high     privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful     attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable     crash (complete DOS) of MySQL Server. (CVE-2021-2194)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2020:3732 advisory.

    * mysql: Server: Security: Privileges multiple unspecified vulnerabilities (CVE-2020-14663,     CVE-2020-14678, CVE-2020-14697, CVE-2020-2761, CVE-2020-2774, CVE-2020-2779, CVE-2020-2853,     CVE-2020-14586, CVE-2020-14702)

    * mysql: Server: Security: Encryption multiple unspecified vulnerabilities (CVE-2019-2914, CVE-2019-2957)

    * mysql: InnoDB multiple unspecified vulnerabilities (CVE-2019-2938, CVE-2019-2963, CVE-2019-2968,     CVE-2019-3018, CVE-2020-2577, CVE-2020-2589, CVE-2020-2760, CVE-2020-2762, CVE-2020-2814, CVE-2020-2893,     CVE-2020-2895, CVE-2020-14568, CVE-2020-14623, CVE-2020-14633, CVE-2020-14634)

    * mysql: Server: PS multiple unspecified vulnerabilities (CVE-2019-2946, CVE-2020-2925)

    * mysql: Server: Replication multiple unspecified vulnerabilities (CVE-2019-2960, CVE-2020-2759,     CVE-2020-2763, CVE-2020-14567)

    * mysql: Server: Optimizer multiple unspecified vulnerabilities (CVE-2019-2966, CVE-2019-2967,     CVE-2019-2974, CVE-2019-2982, CVE-2019-2991, CVE-2019-2998, CVE-2020-2579, CVE-2020-2660, CVE-2020-2679,     CVE-2020-2686, CVE-2020-2765, CVE-2020-2892, CVE-2020-2897, CVE-2020-2901, CVE-2020-2904, CVE-2020-2923,     CVE-2020-2924, CVE-2020-2928, CVE-2020-14539, CVE-2020-14547, CVE-2020-14597, CVE-2020-14614,     CVE-2020-14654, CVE-2020-14680, CVE-2020-14725)

    * mysql: Server: C API multiple unspecified vulnerabilities (CVE-2019-2993, CVE-2019-3011)

    * mysql: Server: DDL multiple unspecified vulnerabilities (CVE-2019-2997, CVE-2020-2580)

    * mysql: Server: Parser multiple unspecified vulnerabilities (CVE-2019-3004, CVE-2020-2627, CVE-2020-2930,     CVE-2020-14619)

    * mysql: Server: Connection unspecified vulnerability (CVE-2019-3009)

    * mysql: Server: Options multiple unspecified vulnerabilities (CVE-2020-2584, CVE-2020-14632)

    * mysql: Server: DML multiple unspecified vulnerabilities (CVE-2020-2588, CVE-2020-2780, CVE-2020-14540,     CVE-2020-14575, CVE-2020-14620)

    * mysql: C API multiple unspecified vulnerabilities (CVE-2020-2752, CVE-2020-2922, CVE-2020-14550,     CVE-2020-2570, CVE-2020-2573, CVE-2020-2574)

    * mysql: Server: Logging unspecified vulnerability (CVE-2020-2770)

    * mysql: Server: Memcached unspecified vulnerability (CVE-2020-2804)

    * mysql: Server: Stored Procedure unspecified vulnerability (CVE-2020-2812)

    * mysql: Server: Information Schema multiple unspecified vulnerabilities (CVE-2020-2896, CVE-2020-14559,     CVE-2020-2694)

    * mysql: Server: Charsets unspecified vulnerability (CVE-2020-2898)

    * mysql: Server: Connection Handling unspecified vulnerability (CVE-2020-2903)

    * mysql: Server: Group Replication Plugin unspecified vulnerability (CVE-2020-2921)

    * mysql: Server: Group Replication GCS unspecified vulnerability (CVE-2020-2926)

    * mysql: Server: Pluggable Auth unspecified vulnerability (CVE-2020-14553)

    * mysql: Server: UDF unspecified vulnerability (CVE-2020-14576)

    * mysql: Server: JSON unspecified vulnerability (CVE-2020-14624)

    * mysql: Server: Security: Audit unspecified vulnerability (CVE-2020-14631)

    * mysql: Server: Security: Roles multiple unspecified vulnerabilities (CVE-2020-14641, CVE-2020-14643,     CVE-2020-14651)

    * mysql: Server: Locking unspecified vulnerability (CVE-2020-14656)

    * mysql: Information Schema unspecified vulnerability (CVE-2019-2911)

Tenable has extracted the preceding description block directly from the Rocky Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3518 advisory.

    MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon, mysqld,     and many client programs.

    The following packages have been upgraded to a later upstream version: rh-mysql80-mysql (8.0.21).

    Security Fix(es):

    * mysql: Server: Security: Privileges multiple unspecified vulnerabilities (CVE-2020-14663,     CVE-2020-14678, CVE-2020-14697, CVE-2020-2761, CVE-2020-2774, CVE-2020-2779, CVE-2020-2853,     CVE-2020-14586, CVE-2020-14702)

    * mysql: Server: Security: Encryption multiple unspecified vulnerabilities (CVE-2019-2914, CVE-2019-2957)

    * mysql: InnoDB multiple unspecified vulnerabilities (CVE-2019-2938, CVE-2019-2963, CVE-2019-2968,     CVE-2019-3018, CVE-2020-2577, CVE-2020-2589, CVE-2020-2760, CVE-2020-2762, CVE-2020-2814, CVE-2020-2893,     CVE-2020-2895, CVE-2020-14568, CVE-2020-14623, CVE-2020-14633, CVE-2020-14634)

    * mysql: Server: PS multiple unspecified vulnerabilities (CVE-2019-2946, CVE-2020-2925)

    * mysql: Server: Replication multiple unspecified vulnerabilities (CVE-2019-2960, CVE-2020-2759,     CVE-2020-2763, CVE-2020-14567)

    * mysql: Server: Optimizer multiple unspecified vulnerabilities (CVE-2019-2966, CVE-2019-2967,     CVE-2019-2974, CVE-2019-2982, CVE-2019-2991, CVE-2019-2998, CVE-2020-2579, CVE-2020-2660, CVE-2020-2679,     CVE-2020-2686, CVE-2020-2765, CVE-2020-2892, CVE-2020-2897, CVE-2020-2901, CVE-2020-2904, CVE-2020-2923,     CVE-2020-2924, CVE-2020-2928, CVE-2020-14539, CVE-2020-14547, CVE-2020-14597, CVE-2020-14614,     CVE-2020-14654, CVE-2020-14680, CVE-2020-14725)

    * mysql: Server: C API multiple unspecified vulnerabilities (CVE-2019-2993, CVE-2019-3011)

    * mysql: Server: DDL multiple unspecified vulnerabilities (CVE-2019-2997, CVE-2020-2580)

    * mysql: Server: Parser multiple unspecified vulnerabilities (CVE-2019-3004, CVE-2020-2627, CVE-2020-2930,     CVE-2020-14619)

    * mysql: Server: Connection unspecified vulnerability (CVE-2019-3009)

    * mysql: Server: Options multiple unspecified vulnerabilities (CVE-2020-2584, CVE-2020-14632)

    * mysql: Server: DML multiple unspecified vulnerabilities (CVE-2020-2588, CVE-2020-2780, CVE-2020-14540,     CVE-2020-14575, CVE-2020-14620)

    * mysql: C API multiple unspecified vulnerabilities (CVE-2020-2752, CVE-2020-2922, CVE-2020-14550,     CVE-2020-2570, CVE-2020-2573, CVE-2020-2574)

    * mysql: Server: Logging unspecified vulnerability (CVE-2020-2770)

    * mysql: Server: Memcached unspecified vulnerability (CVE-2020-2804)

    * mysql: Server: Stored Procedure unspecified vulnerability (CVE-2020-2812)

    * mysql: Server: Information Schema multiple unspecified vulnerabilities (CVE-2020-2896, CVE-2020-14559,     CVE-2020-2694)

    * mysql: Server: Charsets unspecified vulnerability (CVE-2020-2898)

    * mysql: Server: Connection Handling unspecified vulnerability (CVE-2020-2903)

    * mysql: Server: Group Replication Plugin unspecified vulnerability (CVE-2020-2921)

    * mysql: Server: Group Replication GCS unspecified vulnerability (CVE-2020-2926)

    * mysql: Server: Pluggable Auth unspecified vulnerability (CVE-2020-14553)

    * mysql: Server: UDF unspecified vulnerability (CVE-2020-14576)

    * mysql: Server: JSON unspecified vulnerability (CVE-2020-14624)

    * mysql: Server: Security: Audit unspecified vulnerability (CVE-2020-14631)

    * mysql: Server: Security: Roles multiple unspecified vulnerabilities (CVE-2020-14641, CVE-2020-14643,     CVE-2020-14651)

    * mysql: Server: Locking unspecified vulnerability (CVE-2020-14656)

    * mysql: Information Schema unspecified vulnerability (CVE-2019-2911)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:5246 advisory.

    MariaDB is a multi-user, multi-threaded SQL database server. For all practical purposes, MariaDB is     binary-compatible with MySQL.

    The following packages have been upgraded to a later upstream version: rh-mariadb103-mariadb (10.3.27),     rh-mariadb103-galera (25.3.31). (BZ#1894122, BZ#1894124)

    Security Fix(es):

    * mariadb: Insufficient SST method name check leading to code injection in mysql-wsrep (CVE-2020-15180)

    * mysql: Server: Replication unspecified vulnerability (CPU Apr 2019) (CVE-2019-2614)

    * mysql: Server: Security: Privileges unspecified vulnerability (CPU Apr 2019) (CVE-2019-2627)

    * mysql: InnoDB unspecified vulnerability (CPU Apr 2019) (CVE-2019-2628)

    * mysql: Server: Pluggable Auth unspecified vulnerability (CPU Jul 2019) (CVE-2019-2737)

    * mysql: Server: Security: Privileges unspecified vulnerability (CPU Jul 2019) (CVE-2019-2739)

    * mysql: Server: XML unspecified vulnerability (CPU Jul 2019) (CVE-2019-2740)

    * mysql: InnoDB unspecified vulnerability (CPU Jul 2019) (CVE-2019-2758)

    * mysql: Server: Parser unspecified vulnerability (CPU Jul 2019) (CVE-2019-2805)

    * mysql: InnoDB unspecified vulnerability (CPU Oct 2019) (CVE-2019-2938)

    * mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2019) (CVE-2019-2974)

    * mysql: C API unspecified vulnerability (CPU Apr 2020) (CVE-2020-2752)

    * mysql: InnoDB unspecified vulnerability (CPU Apr 2020) (CVE-2020-2760)

    * mysql: Server: DML unspecified vulnerability (CPU Apr 2020) (CVE-2020-2780)

    * mysql: Server: Stored Procedure unspecified vulnerability (CPU Apr 2020) (CVE-2020-2812)

    * mysql: InnoDB unspecified vulnerability (CPU Apr 2020) (CVE-2020-2814)

    * mysql: C API unspecified vulnerability (CPU Apr 2020) (CVE-2020-2922)

    * mariadb-connector-c: Improper validation of content in a OK packet received from server (CVE-2020-13249)

    * mysql: Server: FTS unspecified vulnerability (CPU Oct 2020) (CVE-2020-14765)

    * mysql: InnoDB unspecified vulnerability (CPU Oct 2020) (CVE-2020-14776)

    * mysql: Server: FTS unspecified vulnerability (CPU Oct 2020) (CVE-2020-14789)

    * mysql: Server: Locking unspecified vulnerability (CPU Oct 2020) (CVE-2020-14812)

    * mysql: C API unspecified vulnerability (CPU Jan 2020) (CVE-2020-2574)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * mysqld_safe --dry-run doesn't work as expected (BZ#1894105)

    Enhancement(s):

    * [RFE] create separate package providing ha_connect.so plugin for mariadb-server in SCL (BZ#1894114)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has mariadb packages installed that are affected by multiple vulnerabilities:

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported     versions that are affected are 5.6.45 and prior, 5.7.27 and prior and 8.0.17 and prior. Easily exploitable     vulnerability allows low privileged attacker with network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang     or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability     impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). (CVE-2019-2974)

  - Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are     affected are 5.6.46 and prior, 5.7.28 and prior and 8.0.18 and prior. Difficult to exploit vulnerability     allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Client.
    Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently     repeatable crash (complete DOS) of MySQL Client. CVSS 3.0 Base Score 5.9 (Availability impacts). CVSS     Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). (CVE-2020-2574)

  - Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are     affected are 5.6.47 and prior, 5.7.27 and prior and 8.0.17 and prior. Difficult to exploit vulnerability     allows low privileged attacker with network access via multiple protocols to compromise MySQL Client.
    Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently     repeatable crash (complete DOS) of MySQL Client. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS     Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H). (CVE-2020-2752)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions     that are affected are 5.6.47 and prior, 5.7.29 and prior and 8.0.19 and prior. Easily exploitable     vulnerability allows low privileged attacker with network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang     or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability     impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). (CVE-2020-2780)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure). Supported     versions that are affected are 5.6.47 and prior, 5.7.29 and prior and 8.0.19 and prior. Easily exploitable     vulnerability allows high privileged attacker with network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang     or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability     impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). (CVE-2020-2812)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser). Supported versions     that are affected are 5.7.29 and prior and 8.0.19 and prior. Easily exploitable vulnerability allows high     privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful     attacks of this vulnerability can result in takeover of MySQL Server. CVSS 3.1 Base Score 7.2     (Confidentiality, Integrity and Availability impacts). CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). (CVE-2021-2144)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Oracle reports :

This Critical Patch Update contains 49 new security patches for Oracle MySQL. 10 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle MySQL is 9.8.

MariaDB is affected by CVE-2021-2166 and CVE-2021-2154 only

The version of MySQL running on the remote host is 8.0.x prior to 8.0.20. It is, therefore, affected by multiple vulnerabilities, including the following, as noted in the April 2020 Critical Patch Update advisory:

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser). Supported versions   that are affected are 5.7.29 and prior and 8.0.19 and prior. Easily exploitable vulnerability allows high   privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of   this vulnerability can result in takeover of MySQL Server. (CVE-2021-2144)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Memcached). Supported versions   that are affected are 5.6.47 and prior, 5.7.29 and prior and 8.0.19 and prior. This difficult to exploit   vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server.
  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently   repeatable crash (complete DOS) of MySQL Server. (CVE-2020-2804)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported   versions that are affected are 5.6.47 and prior, 5.7.29 and prior and 8.0.19 and prior. This easily exploitable   vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.
  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently   repeatable crash (complete DOS) of MySQL Server. (CVE-2020-2763)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:5663 advisory.

    MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL.

    The following packages have been upgraded to a later upstream version: mariadb (10.3.27), galera     (25.3.31). (BZ#1899085, BZ#1899089)

    Security Fix(es):

    * mariadb: Insufficient SST method name check leading to code injection in mysql-wsrep (CVE-2020-15180)

    * mysql: InnoDB unspecified vulnerability (CPU Jan 2019) (CVE-2019-2510)

    * mysql: Server: DDL unspecified vulnerability (CPU Jan 2019) (CVE-2019-2537)

    * mysql: Server: Replication unspecified vulnerability (CPU Apr 2019) (CVE-2019-2614)

    * mysql: Server: Security: Privileges unspecified vulnerability (CPU Apr 2019) (CVE-2019-2627)

    * mysql: InnoDB unspecified vulnerability (CPU Apr 2019) (CVE-2019-2628)

    * mysql: Server: Pluggable Auth unspecified vulnerability (CPU Jul 2019) (CVE-2019-2737)

    * mysql: Server: Security: Privileges unspecified vulnerability (CPU Jul 2019) (CVE-2019-2739)

    * mysql: Server: XML unspecified vulnerability (CPU Jul 2019) (CVE-2019-2740)

    * mysql: InnoDB unspecified vulnerability (CPU Jul 2019) (CVE-2019-2758)

    * mysql: Server: Parser unspecified vulnerability (CPU Jul 2019) (CVE-2019-2805)

    * mysql: InnoDB unspecified vulnerability (CPU Oct 2019) (CVE-2019-2938)

    * mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2019) (CVE-2019-2974)

    * mysql: C API unspecified vulnerability (CPU Apr 2020) (CVE-2020-2752)

    * mysql: InnoDB unspecified vulnerability (CPU Apr 2020) (CVE-2020-2760)

    * mysql: Server: DML unspecified vulnerability (CPU Apr 2020) (CVE-2020-2780)

    * mysql: Server: Stored Procedure unspecified vulnerability (CPU Apr 2020) (CVE-2020-2812)

    * mysql: InnoDB unspecified vulnerability (CPU Apr 2020) (CVE-2020-2814)

    * mysql: C API unspecified vulnerability (CPU Apr 2020) (CVE-2020-2922)

    * mariadb-connector-c: Improper validation of content in a OK packet received from server (CVE-2020-13249)

    * mysql: Server: FTS unspecified vulnerability (CPU Oct 2020) (CVE-2020-14765)

    * mysql: InnoDB unspecified vulnerability (CPU Oct 2020) (CVE-2020-14776)

    * mysql: Server: FTS unspecified vulnerability (CPU Oct 2020) (CVE-2020-14789)

    * mysql: Server: Locking unspecified vulnerability (CPU Oct 2020) (CVE-2020-14812)

    * mysql: C API unspecified vulnerability (CPU Jan 2020) (CVE-2020-2574)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * FTBFS: -D_GLIBCXX_ASSERTIONS (BZ#1899012)

    * Queries with entity_id IN ('1', '2', , '70000') run much slower in MariaDB 10.3 than on MariaDB 10.1     (BZ#1899020)

    * Cleanup race with wsrep_rsync_sst_tunnel may prevent full galera cluster bootstrap (BZ#1899025)

    * There are undeclared file conflicts in several mariadb and mysql packages (BZ#1899080)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:5665 advisory.

    MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL.

    The following packages have been upgraded to a later upstream version: mariadb (10.3.27), galera     (25.3.31). (BZ#1899084, BZ#1899088)

    Security Fix(es):

    * mariadb: Insufficient SST method name check leading to code injection in mysql-wsrep (CVE-2020-15180)

    * mysql: InnoDB unspecified vulnerability (CPU Oct 2019) (CVE-2019-2938)

    * mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2019) (CVE-2019-2974)

    * mysql: C API unspecified vulnerability (CPU Apr 2020) (CVE-2020-2752)

    * mysql: InnoDB unspecified vulnerability (CPU Apr 2020) (CVE-2020-2760)

    * mysql: Server: DML unspecified vulnerability (CPU Apr 2020) (CVE-2020-2780)

    * mysql: Server: Stored Procedure unspecified vulnerability (CPU Apr 2020) (CVE-2020-2812)

    * mysql: InnoDB unspecified vulnerability (CPU Apr 2020) (CVE-2020-2814)

    * mariadb-connector-c: Improper validation of content in a OK packet received from server (CVE-2020-13249)

    * mysql: Server: FTS unspecified vulnerability (CPU Oct 2020) (CVE-2020-14765)

    * mysql: InnoDB unspecified vulnerability (CPU Oct 2020) (CVE-2020-14776)

    * mysql: Server: FTS unspecified vulnerability (CPU Oct 2020) (CVE-2020-14789)

    * mysql: Server: Locking unspecified vulnerability (CPU Oct 2020) (CVE-2020-14812)

    * mysql: C API unspecified vulnerability (CPU Jan 2020) (CVE-2020-2574)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * FTBFS: -D_GLIBCXX_ASSERTIONS (BZ#1899011)

    * Queries with entity_id IN ('1', '2', , '70000') run much slower in MariaDB 10.3 than on MariaDB 10.1     (BZ#1899019)

    * Cleanup race with wsrep_rsync_sst_tunnel may prevent full galera cluster bootstrap (BZ#1899024)

    * There are undeclared file conflicts in several mariadb and mysql packages (BZ#1899079)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:5654 advisory.

    MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL.

    The following packages have been upgraded to a later upstream version: mariadb (10.3.27), galera     (25.3.31). (BZ#1899083, BZ#1899087)

    Security Fix(es):

    * mariadb: Insufficient SST method name check leading to code injection in mysql-wsrep (CVE-2020-15180)

    * mysql: InnoDB unspecified vulnerability (CPU Oct 2019) (CVE-2019-2938)

    * mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2019) (CVE-2019-2974)

    * mysql: C API unspecified vulnerability (CPU Apr 2020) (CVE-2020-2752)

    * mysql: InnoDB unspecified vulnerability (CPU Apr 2020) (CVE-2020-2760)

    * mysql: Server: DML unspecified vulnerability (CPU Apr 2020) (CVE-2020-2780)

    * mysql: Server: Stored Procedure unspecified vulnerability (CPU Apr 2020) (CVE-2020-2812)

    * mysql: InnoDB unspecified vulnerability (CPU Apr 2020) (CVE-2020-2814)

    * mariadb-connector-c: Improper validation of content in a OK packet received from server (CVE-2020-13249)

    * mysql: Server: FTS unspecified vulnerability (CPU Oct 2020) (CVE-2020-14765)

    * mysql: InnoDB unspecified vulnerability (CPU Oct 2020) (CVE-2020-14776)

    * mysql: Server: FTS unspecified vulnerability (CPU Oct 2020) (CVE-2020-14789)

    * mysql: Server: Locking unspecified vulnerability (CPU Oct 2020) (CVE-2020-14812)

    * mysql: C API unspecified vulnerability (CPU Jan 2020) (CVE-2020-2574)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * FTBFS: -D_GLIBCXX_ASSERTIONS (BZ#1899010)

    * Queries with entity_id IN ('1', '2', , '70000') run much slower in MariaDB 10.3 than on MariaDB 10.1     (BZ#1899018)

    * Cleanup race with wsrep_rsync_sst_tunnel may prevent full galera cluster bootstrap (BZ#1899022)

    * There are undeclared file conflicts in several mariadb and mysql packages (BZ#1899078)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:5500 advisory.

    MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL.

    The following packages have been upgraded to a later upstream version: mariadb (10.3.27), galera     (25.3.31). (BZ#1899082, BZ#1899086)

    Security Fix(es):

    * mariadb: Insufficient SST method name check leading to code injection in mysql-wsrep (CVE-2020-15180)

    * mysql: InnoDB unspecified vulnerability (CPU Oct 2019) (CVE-2019-2938)

    * mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2019) (CVE-2019-2974)

    * mysql: C API unspecified vulnerability (CPU Apr 2020) (CVE-2020-2752)

    * mysql: InnoDB unspecified vulnerability (CPU Apr 2020) (CVE-2020-2760)

    * mysql: Server: DML unspecified vulnerability (CPU Apr 2020) (CVE-2020-2780)

    * mysql: Server: Stored Procedure unspecified vulnerability (CPU Apr 2020) (CVE-2020-2812)

    * mysql: InnoDB unspecified vulnerability (CPU Apr 2020) (CVE-2020-2814)

    * mariadb-connector-c: Improper validation of content in a OK packet received from server (CVE-2020-13249)

    * mysql: Server: FTS unspecified vulnerability (CPU Oct 2020) (CVE-2020-14765)

    * mysql: InnoDB unspecified vulnerability (CPU Oct 2020) (CVE-2020-14776)

    * mysql: Server: FTS unspecified vulnerability (CPU Oct 2020) (CVE-2020-14789)

    * mysql: Server: Locking unspecified vulnerability (CPU Oct 2020) (CVE-2020-14812)

    * mysql: C API unspecified vulnerability (CPU Jan 2020) (CVE-2020-2574)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * FTBFS: -D_GLIBCXX_ASSERTIONS (BZ#1899009)

    * Queries with entity_id IN ('1', '2', , '70000') run much slower in MariaDB 10.3 than on MariaDB 10.1     (BZ#1899017)

    * Cleanup race with wsrep_rsync_sst_tunnel may prevent full galera cluster bootstrap (BZ#1899021)

    * There are undeclared file conflicts in several mariadb and mysql packages (BZ#1899077)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3732 advisory.

    MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon (mysqld)     and many client programs and libraries.

    The following packages have been upgraded to a later upstream version: mysql (8.0.21).

    Security Fix(es):

    * mysql: Server: Security: Privileges multiple unspecified vulnerabilities (CVE-2020-14663,     CVE-2020-14678, CVE-2020-14697, CVE-2020-2761, CVE-2020-2774, CVE-2020-2779, CVE-2020-2853,     CVE-2020-14586, CVE-2020-14702)

    * mysql: Server: Security: Encryption multiple unspecified vulnerabilities (CVE-2019-2914, CVE-2019-2957)

    * mysql: InnoDB multiple unspecified vulnerabilities (CVE-2019-2938, CVE-2019-2963, CVE-2019-2968,     CVE-2019-3018, CVE-2020-2577, CVE-2020-2589, CVE-2020-2760, CVE-2020-2762, CVE-2020-2814, CVE-2020-2893,     CVE-2020-2895, CVE-2020-14568, CVE-2020-14623, CVE-2020-14633, CVE-2020-14634)

    * mysql: Server: PS multiple unspecified vulnerabilities (CVE-2019-2946, CVE-2020-2925)

    * mysql: Server: Replication multiple unspecified vulnerabilities (CVE-2019-2960, CVE-2020-2759,     CVE-2020-2763, CVE-2020-14567)

    * mysql: Server: Optimizer multiple unspecified vulnerabilities (CVE-2019-2966, CVE-2019-2967,     CVE-2019-2974, CVE-2019-2982, CVE-2019-2991, CVE-2019-2998, CVE-2020-2579, CVE-2020-2660, CVE-2020-2679,     CVE-2020-2686, CVE-2020-2765, CVE-2020-2892, CVE-2020-2897, CVE-2020-2901, CVE-2020-2904, CVE-2020-2923,     CVE-2020-2924, CVE-2020-2928, CVE-2020-14539, CVE-2020-14547, CVE-2020-14597, CVE-2020-14614,     CVE-2020-14654, CVE-2020-14680, CVE-2020-14725)

    * mysql: Server: C API multiple unspecified vulnerabilities (CVE-2019-2993, CVE-2019-3011)

    * mysql: Server: DDL multiple unspecified vulnerabilities (CVE-2019-2997, CVE-2020-2580)

    * mysql: Server: Parser multiple unspecified vulnerabilities (CVE-2019-3004, CVE-2020-2627, CVE-2020-2930,     CVE-2020-14619)

    * mysql: Server: Connection unspecified vulnerability (CVE-2019-3009)

    * mysql: Server: Options multiple unspecified vulnerabilities (CVE-2020-2584, CVE-2020-14632)

    * mysql: Server: DML multiple unspecified vulnerabilities (CVE-2020-2588, CVE-2020-2780, CVE-2020-14540,     CVE-2020-14575, CVE-2020-14620)

    * mysql: C API multiple unspecified vulnerabilities (CVE-2020-2752, CVE-2020-2922, CVE-2020-14550,     CVE-2020-2570, CVE-2020-2573, CVE-2020-2574)

    * mysql: Server: Logging unspecified vulnerability (CVE-2020-2770)

    * mysql: Server: Memcached unspecified vulnerability (CVE-2020-2804)

    * mysql: Server: Stored Procedure unspecified vulnerability (CVE-2020-2812)

    * mysql: Server: Information Schema multiple unspecified vulnerabilities (CVE-2020-2896, CVE-2020-14559,     CVE-2020-2694)

    * mysql: Server: Charsets unspecified vulnerability (CVE-2020-2898)

    * mysql: Server: Connection Handling unspecified vulnerability (CVE-2020-2903)

    * mysql: Server: Group Replication Plugin unspecified vulnerability (CVE-2020-2921)

    * mysql: Server: Group Replication GCS unspecified vulnerability (CVE-2020-2926)

    * mysql: Server: Pluggable Auth unspecified vulnerability (CVE-2020-14553)

    * mysql: Server: UDF unspecified vulnerability (CVE-2020-14576)

    * mysql: Server: JSON unspecified vulnerability (CVE-2020-14624)

    * mysql: Server: Security: Audit unspecified vulnerability (CVE-2020-14631)

    * mysql: Server: Security: Roles multiple unspecified vulnerabilities (CVE-2020-14641, CVE-2020-14643,     CVE-2020-14651)

    * mysql: Server: Locking unspecified vulnerability (CVE-2020-14656)

    * mysql: Information Schema unspecified vulnerability (CVE-2019-2911)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of mariadb installed on the remote host is prior to 5.5.68-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1537 advisory.

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server : Pluggable Auth).
    Supported versions that are affected are 5.6.44 and prior, 5.7.26 and prior and 8.0.16 and prior. Easily     exploitable vulnerability allows high privileged attacker with network access via multiple protocols to     compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to     cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9     (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). (CVE-2019-2737)

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Privileges).
    Supported versions that are affected are 5.6.44 and prior, 5.7.26 and prior and 8.0.16 and prior. Easily     exploitable vulnerability allows high privileged attacker with logon to the infrastructure where MySQL     Server executes to compromise MySQL Server. Successful attacks of this vulnerability can result in     unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well     as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.0 Base     Score 5.1 (Integrity and Availability impacts). CVSS Vector:
    (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H). (CVE-2019-2739)

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: XML). Supported     versions that are affected are 5.6.44 and prior, 5.7.26 and prior and 8.0.16 and prior. Easily exploitable     vulnerability allows low privileged attacker with network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang     or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability     impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). (CVE-2019-2740)

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Parser). Supported     versions that are affected are 5.6.44 and prior, 5.7.26 and prior and 8.0.16 and prior. Easily exploitable     vulnerability allows low privileged attacker with network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang     or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability     impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). (CVE-2019-2805)

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported     versions that are affected are 5.6.45 and prior, 5.7.27 and prior and 8.0.17 and prior. Easily exploitable     vulnerability allows low privileged attacker with network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang     or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability     impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). (CVE-2019-2974)

    Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are     affected are 5.6.46 and prior, 5.7.28 and prior and 8.0.18 and prior. Difficult to exploit vulnerability     allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Client.
    Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently     repeatable crash (complete DOS) of MySQL Client. CVSS 3.0 Base Score 5.9 (Availability impacts). CVSS     Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). (CVE-2020-2574)

    Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are     affected are 5.6.47 and prior, 5.7.27 and prior and 8.0.17 and prior. Difficult to exploit vulnerability     allows low privileged attacker with network access via multiple protocols to compromise MySQL Client.
    Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently     repeatable crash (complete DOS) of MySQL Client. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS     Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H). (CVE-2020-2752)

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions     that are affected are 5.6.47 and prior, 5.7.29 and prior and 8.0.19 and prior. Easily exploitable     vulnerability allows low privileged attacker with network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang     or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability     impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). (CVE-2020-2780)

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure). Supported     versions that are affected are 5.6.47 and prior, 5.7.29 and prior and 8.0.19 and prior. Easily exploitable     vulnerability allows high privileged attacker with network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang     or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability     impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). (CVE-2020-2812)

    Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are     affected are 5.6.47 and prior, 5.7.29 and prior and 8.0.18 and prior. Difficult to exploit vulnerability     allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Client.
    Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL     Client accessible data. CVSS 3.0 Base Score 3.7 (Confidentiality impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N). (CVE-2020-2922)

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser). Supported versions     that are affected are 5.7.29 and prior and 8.0.19 and prior. Easily exploitable vulnerability allows high     privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful     attacks of this vulnerability can result in takeover of MySQL Server. CVSS 3.1 Base Score 7.2     (Confidentiality, Integrity and Availability impacts). CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). (CVE-2021-2144)

    CVE-2021-2144added after the original release, but was fixed in the package released on 2020-10-22.

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4026 advisory.

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported     versions that are affected are 5.6.45 and prior, 5.7.27 and prior and 8.0.17 and prior. Easily exploitable     vulnerability allows low privileged attacker with network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang     or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2019-2974)

  - Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are     affected are 5.6.46 and prior, 5.7.28 and prior and 8.0.18 and prior. Difficult to exploit vulnerability     allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Client.
    Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently     repeatable crash (complete DOS) of MySQL Client. (CVE-2020-2574)

  - Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are     affected are 5.6.47 and prior, 5.7.27 and prior and 8.0.17 and prior. Difficult to exploit vulnerability     allows low privileged attacker with network access via multiple protocols to compromise MySQL Client.
    Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently     repeatable crash (complete DOS) of MySQL Client. (CVE-2020-2752)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions     that are affected are 5.6.47 and prior, 5.7.29 and prior and 8.0.19 and prior. Easily exploitable     vulnerability allows low privileged attacker with network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang     or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2020-2780)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure). Supported     versions that are affected are 5.6.47 and prior, 5.7.29 and prior and 8.0.19 and prior. Easily exploitable     vulnerability allows high privileged attacker with network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang     or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2020-2812)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser). Supported versions     that are affected are 5.7.29 and prior and 8.0.19 and prior. Easily exploitable vulnerability allows high     privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful     attacks of this vulnerability can result in takeover of MySQL Server. (CVE-2021-2144)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4026 advisory.

    MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL.

    The following packages have been upgraded to a later upstream version: mariadb (5.5.68). (BZ#1769276)

    Security Fix(es):

    * mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2019) (CVE-2019-2974)

    * mysql: C API unspecified vulnerability (CPU Apr 2020) (CVE-2020-2752)

    * mysql: Server: DML unspecified vulnerability (CPU Apr 2020) (CVE-2020-2780)

    * mysql: Server: Stored Procedure unspecified vulnerability (CPU Apr 2020) (CVE-2020-2812)

    * mysql: C API: unspecified vulnerability (CPU Jan 2020) (CVE-2020-2574)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.9 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3757 advisory.

    MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon (mysqld)     and many client programs and libraries.

    The following packages have been upgraded to a later upstream version: mysql (8.0.21).

    Security Fix(es):

    * mysql: Server: Security: Privileges multiple unspecified vulnerabilities (CVE-2020-14663,     CVE-2020-14678, CVE-2020-14697, CVE-2020-2761, CVE-2020-2774, CVE-2020-2779, CVE-2020-2853,     CVE-2020-14586, CVE-2020-14702)

    * mysql: Server: Security: Encryption multiple unspecified vulnerabilities (CVE-2019-2914, CVE-2019-2957)

    * mysql: InnoDB multiple unspecified vulnerabilities (CVE-2019-2938, CVE-2019-2963, CVE-2019-2968,     CVE-2019-3018, CVE-2020-2577, CVE-2020-2589, CVE-2020-2760, CVE-2020-2762, CVE-2020-2814, CVE-2020-2893,     CVE-2020-2895, CVE-2020-14568, CVE-2020-14623, CVE-2020-14633, CVE-2020-14634)

    * mysql: Server: PS multiple unspecified vulnerabilities (CVE-2019-2946, CVE-2020-2925)

    * mysql: Server: Replication multiple unspecified vulnerabilities (CVE-2019-2960, CVE-2020-2759,     CVE-2020-2763, CVE-2020-14567)

    * mysql: Server: Optimizer multiple unspecified vulnerabilities (CVE-2019-2966, CVE-2019-2967,     CVE-2019-2974, CVE-2019-2982, CVE-2019-2991, CVE-2019-2998, CVE-2020-2579, CVE-2020-2660, CVE-2020-2679,     CVE-2020-2686, CVE-2020-2765, CVE-2020-2892, CVE-2020-2897, CVE-2020-2901, CVE-2020-2904, CVE-2020-2923,     CVE-2020-2924, CVE-2020-2928, CVE-2020-14539, CVE-2020-14547, CVE-2020-14597, CVE-2020-14614,     CVE-2020-14654, CVE-2020-14680, CVE-2020-14725)

    * mysql: Server: C API multiple unspecified vulnerabilities (CVE-2019-2993, CVE-2019-3011)

    * mysql: Server: DDL multiple unspecified vulnerabilities (CVE-2019-2997, CVE-2020-2580)

    * mysql: Server: Parser multiple unspecified vulnerabilities (CVE-2019-3004, CVE-2020-2627, CVE-2020-2930,     CVE-2020-14619)

    * mysql: Server: Connection unspecified vulnerability (CVE-2019-3009)

    * mysql: Server: Options multiple unspecified vulnerabilities (CVE-2020-2584, CVE-2020-14632)

    * mysql: Server: DML multiple unspecified vulnerabilities (CVE-2020-2588, CVE-2020-2780, CVE-2020-14540,     CVE-2020-14575, CVE-2020-14620)

    * mysql: C API multiple unspecified vulnerabilities (CVE-2020-2752, CVE-2020-2922, CVE-2020-14550,     CVE-2020-2570, CVE-2020-2573, CVE-2020-2574)

    * mysql: Server: Logging unspecified vulnerability (CVE-2020-2770)

    * mysql: Server: Memcached unspecified vulnerability (CVE-2020-2804)

    * mysql: Server: Stored Procedure unspecified vulnerability (CVE-2020-2812)

    * mysql: Server: Information Schema multiple unspecified vulnerabilities (CVE-2020-2896, CVE-2020-14559,     CVE-2020-2694)

    * mysql: Server: Charsets unspecified vulnerability (CVE-2020-2898)

    * mysql: Server: Connection Handling unspecified vulnerability (CVE-2020-2903)

    * mysql: Server: Group Replication Plugin unspecified vulnerability (CVE-2020-2921)

    * mysql: Server: Group Replication GCS unspecified vulnerability (CVE-2020-2926)

    * mysql: Server: Pluggable Auth unspecified vulnerability (CVE-2020-14553)

    * mysql: Server: UDF unspecified vulnerability (CVE-2020-14576)

    * mysql: Server: JSON unspecified vulnerability (CVE-2020-14624)

    * mysql: Server: Security: Audit unspecified vulnerability (CVE-2020-14631)

    * mysql: Server: Security: Roles multiple unspecified vulnerabilities (CVE-2020-14641, CVE-2020-14643,     CVE-2020-14651)

    * mysql: Server: Locking unspecified vulnerability (CVE-2020-14656)

    * mysql: Information Schema unspecified vulnerability (CVE-2019-2911)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3755 advisory.

    MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon (mysqld)     and many client programs and libraries.

    The following packages have been upgraded to a later upstream version: mysql (8.0.21).

    Security Fix(es):

    * mysql: Server: Security: Privileges multiple unspecified vulnerabilities (CVE-2020-14663,     CVE-2020-14678, CVE-2020-14697, CVE-2020-2761, CVE-2020-2774, CVE-2020-2779, CVE-2020-2853,     CVE-2020-14586, CVE-2020-14702)

    * mysql: Server: Security: Encryption multiple unspecified vulnerabilities (CVE-2019-2914, CVE-2019-2957)

    * mysql: InnoDB multiple unspecified vulnerabilities (CVE-2019-2938, CVE-2019-2963, CVE-2019-2968,     CVE-2019-3018, CVE-2020-2577, CVE-2020-2589, CVE-2020-2760, CVE-2020-2762, CVE-2020-2814, CVE-2020-2893,     CVE-2020-2895, CVE-2020-14568, CVE-2020-14623, CVE-2020-14633, CVE-2020-14634)

    * mysql: Server: PS multiple unspecified vulnerabilities (CVE-2019-2946, CVE-2020-2925)

    * mysql: Server: Replication multiple unspecified vulnerabilities (CVE-2019-2960, CVE-2020-2759,     CVE-2020-2763, CVE-2020-14567)

    * mysql: Server: Optimizer multiple unspecified vulnerabilities (CVE-2019-2966, CVE-2019-2967,     CVE-2019-2974, CVE-2019-2982, CVE-2019-2991, CVE-2019-2998, CVE-2020-2579, CVE-2020-2660, CVE-2020-2679,     CVE-2020-2686, CVE-2020-2765, CVE-2020-2892, CVE-2020-2897, CVE-2020-2901, CVE-2020-2904, CVE-2020-2923,     CVE-2020-2924, CVE-2020-2928, CVE-2020-14539, CVE-2020-14547, CVE-2020-14597, CVE-2020-14614,     CVE-2020-14654, CVE-2020-14680, CVE-2020-14725)

    * mysql: Server: C API multiple unspecified vulnerabilities (CVE-2019-2993, CVE-2019-3011)

    * mysql: Server: DDL multiple unspecified vulnerabilities (CVE-2019-2997, CVE-2020-2580)

    * mysql: Server: Parser multiple unspecified vulnerabilities (CVE-2019-3004, CVE-2020-2627, CVE-2020-2930,     CVE-2020-14619)

    * mysql: Server: Connection unspecified vulnerability (CVE-2019-3009)

    * mysql: Server: Options multiple unspecified vulnerabilities (CVE-2020-2584, CVE-2020-14632)

    * mysql: Server: DML multiple unspecified vulnerabilities (CVE-2020-2588, CVE-2020-2780, CVE-2020-14540,     CVE-2020-14575, CVE-2020-14620)

    * mysql: C API multiple unspecified vulnerabilities (CVE-2020-2752, CVE-2020-2922, CVE-2020-14550,     CVE-2020-2570, CVE-2020-2573, CVE-2020-2574)

    * mysql: Server: Logging unspecified vulnerability (CVE-2020-2770)

    * mysql: Server: Memcached unspecified vulnerability (CVE-2020-2804)

    * mysql: Server: Stored Procedure unspecified vulnerability (CVE-2020-2812)

    * mysql: Server: Information Schema multiple unspecified vulnerabilities (CVE-2020-2896, CVE-2020-14559,     CVE-2020-2694)

    * mysql: Server: Charsets unspecified vulnerability (CVE-2020-2898)

    * mysql: Server: Connection Handling unspecified vulnerability (CVE-2020-2903)

    * mysql: Server: Group Replication Plugin unspecified vulnerability (CVE-2020-2921)

    * mysql: Server: Group Replication GCS unspecified vulnerability (CVE-2020-2926)

    * mysql: Server: Pluggable Auth unspecified vulnerability (CVE-2020-14553)

    * mysql: Server: UDF unspecified vulnerability (CVE-2020-14576)

    * mysql: Server: JSON unspecified vulnerability (CVE-2020-14624)

    * mysql: Server: Security: Audit unspecified vulnerability (CVE-2020-14631)

    * mysql: Server: Security: Roles multiple unspecified vulnerabilities (CVE-2020-14641, CVE-2020-14643,     CVE-2020-14651)

    * mysql: Server: Locking unspecified vulnerability (CVE-2020-14656)

    * mysql: Information Schema unspecified vulnerability (CVE-2019-2911)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of MySQL running on the remote host is 5.7.x prior to 5.7.30. It is, therefore, affected by multiple vulnerabilities, as noted in the April 2020 Critical Patch Update advisory:


  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser). Supported versions   that are affected are 5.7.29 and prior and 8.0.19 and prior. Easily exploitable vulnerability allows high   privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of   this vulnerability can result in takeover of MySQL Server. (CVE-2021-2144)

  - Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are   affected are 5.6.47 and prior, 5.7.29 and prior and 8.0.18 and prior. This difficult to exploit vulnerability allows   unauthenticated attacker with network access via multiple protocols to compromise MySQL Client. Successful   attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Client accessible data. (CVE-2020-2922)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are   affected are 5.7.29 and prior and 8.0.19 and prior. Easily exploitable vulnerability allows high privileged   attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this   vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of   MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. (CVE-2020-2760)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of MariaDB installed on the remote host is 5.5.x prior to 5.5.66. It is, therefore, affected by a denial of service vulnerability in the following Oracle MySQL components: InnoDB, Optimizer and PS. An authenticated, remote attacker can exploit this issue, to cause a hang or frequently repeatable crash of MySQL Server.

The version of MariaDB installed on the remote host is 10.3.x prior to 10.3.19. It is, therefore, affected by multiple denial of service vulnerabilities:

  - Multiple denial of service vulnerabilities exists in the following Oracle MySQL components: InnoDB,     Optimizer and PS. An authenticated, remote attacker can exploit this issue, to cause a hang or frequently     repeatable crash of MySQL Server. (CVE-2019-2938, CVE-2019-2974)

The version of MariaDB installed on the remote host is 10.2.x prior to 10.2.28. It is, therefore, affected by multiple denial of service vulnerabilities:

  - Multiple denial of service vulnerabilities exists in the following Oracle MySQL components: InnoDB,     Optimizer and PS. An authenticated, remote attacker can exploit this issue, to cause a hang or frequently     repeatable crash of MySQL Server. (CVE-2019-2938, CVE-2019-2974)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of MariaDB installed on the remote host is 10.4.x prior to 10.4.9. It is, therefore, affected by multiple denial of service vulnerabilities:

  - Multiple denial of service vulnerabilities exists in the following Oracle MySQL components: InnoDB,     Optimizer and PS. An authenticated, remote attacker can exploit this issue, to cause a hang or frequently     repeatable crash of MySQL Server. (CVE-2019-2938, CVE-2019-2974)

The version of MariaDB installed on the remote host is 10.1.x prior to 10.1.42. It is, therefore, affected by a denial of service vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer and PS). An authenticated, remote attacker can exploit this issue, to cause a hang or frequently repeatable crash of MySQL Server.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
184764	Rocky Linux 8 : mariadb:10.3 (RLSA-2020:5500)	Nessus	Rocky Linux Local Security Checks	critical
184570	Rocky Linux 8 : mysql:8.0 (RLSA-2020:3732)	Nessus	Rocky Linux Local Security Checks	high
170309	RHEL 7 : rh-mysql80-mysql (RHSA-2020:3518)	Nessus	Red Hat Local Security Checks	high
170298	RHEL 7 : rh-mariadb103-mariadb and rh-mariadb103-galera (RHSA-2020:5246)	Nessus	Red Hat Local Security Checks	critical
154603	NewStart CGSL CORE 5.05 / MAIN 5.05 : mariadb Multiple Vulnerabilities (NS-SA-2021-0162)	Nessus	NewStart CGSL Local Security Checks	medium
148869	FreeBSD : MySQL -- Multiple vulnerabilities (56ba4513-a1be-11eb-9072-d4c9ef517024)	Nessus	FreeBSD Local Security Checks	medium
135701	MySQL 8.0.x < 8.0.20 Multiple Vulnerabilities (Apr 2020 CPU)	Nessus	Databases	medium
144555	RHEL 8 : mariadb:10.3 (RHSA-2020:5663)	Nessus	Red Hat Local Security Checks	critical
144550	RHEL 8 : mariadb:10.3 (RHSA-2020:5665)	Nessus	Red Hat Local Security Checks	critical
144548	RHEL 8 : mariadb:10.3 (RHSA-2020:5654)	Nessus	Red Hat Local Security Checks	critical
144418	RHEL 8 : mariadb:10.3 (RHSA-2020:5500)	Nessus	Red Hat Local Security Checks	critical
143030	RHEL 8 : mysql:8.0 (RHSA-2020:3732)	Nessus	Red Hat Local Security Checks	high
142022	Amazon Linux 2 : mariadb (ALAS-2020-1537)	Nessus	Amazon Linux Local Security Checks	medium
141610	CentOS 7 : mariadb (RHSA-2020:4026)	Nessus	CentOS Local Security Checks	medium
141035	RHEL 7 : mariadb (RHSA-2020:4026)	Nessus	Red Hat Local Security Checks	medium
140599	RHEL 8 : mysql:8.0 (RHSA-2020:3757)	Nessus	Red Hat Local Security Checks	high
140598	RHEL 8 : mysql:8.0 (RHSA-2020:3755)	Nessus	Red Hat Local Security Checks	high
135700	MySQL 5.7.x < 5.7.30 Multiple Vulnerabilities (Jan 2020 CPU)	Nessus	Databases	medium
132079	MariaDB 5.5.x < 5.5.66 Denial of Service Vulnerability	Nessus	Databases	medium
132054	MariaDB 10.3.x < 10.3.19 Multiple Denial of Service Vulnerabilities	Nessus	Databases	medium
132051	MariaDB 10.2.x < 10.2.28 Multiple Denial of Service Vulnerabilities	Nessus	Databases	medium
132050	MariaDB 10.4.x < 10.4.9 Multiple Denial of Service Vulnerabilities	Nessus	Databases	medium
131289	MariaDB 10.1.x < 10.1.42 Denial Of Service Vulnerability	Nessus	Databases	medium

Detections

Analytics

CVE-2021-2144

high

Tenable Plugins

critical

high

high

critical

medium

medium

medium

critical

critical

critical

critical

high

medium

medium

medium

high

high

medium

medium

medium

medium

medium

medium