Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication). Supported versions that are affected are 5.7.23 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server. CVSS 3.0 Base Score 5.4 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L).

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication). Supported     versions that are affected are 5.7.23 and prior. Easily exploitable vulnerability allows low privileged     attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this     vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server     accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of MySQL     Server. (CVE-2019-2731)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:3655 advisory.

    MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon, mysqld,     and many client programs.

    The following packages have been upgraded to a later upstream version: rh-mysql57-mysql (5.7.24).
    (BZ#1642523, BZ#1643049, BZ#1643060)

    Security Fix(es):

    * mysql: Server: Replication unspecified vulnerability (CPU Apr 2018) (CVE-2018-2755)

    * mysql: Server: Security: Privileges multiple unspecified vulnerabilities (CPU Apr 2018) (CVE-2018-2758,     CVE-2018-2818)

    * mysql: InnoDB multiple unspecified vulnerabilities (CPU Apr 2018) (CVE-2018-2759, CVE-2018-2766,     CVE-2018-2777, CVE-2018-2782, CVE-2018-2784, CVE-2018-2786, CVE-2018-2787, CVE-2018-2810, CVE-2018-2819)

    * mysql: Client programs unspecified vulnerability (CPU Apr 2018) (CVE-2018-2761)

    * mysql: Server: Connection unspecified vulnerability (CPU Apr 2018) (CVE-2018-2762)

    * mysql: Server: Pluggable Auth unspecified vulnerability (CPU Apr 2018) (CVE-2018-2769)

    * mysql: Server: Locking unspecified vulnerability (CPU Apr 2018) (CVE-2018-2771)

    * mysql: Server: Optimizer multiple unspecified vulnerabilities (CPU Apr 2018) (CVE-2018-2775,     CVE-2018-2778, CVE-2018-2779, CVE-2018-2780, CVE-2018-2781, CVE-2018-2812, CVE-2018-2816)

    * mysql: Group Replication GCS unspecified vulnerability (CPU Apr 2018) (CVE-2018-2776)

    * mysql: Server: DDL multiple unspecified vulnerabilities (CPU Apr 2018) (CVE-2018-2813, CVE-2018-2817)

    * mysql: Server: DML unspecified vulnerability (CPU Apr 2018) (CVE-2018-2839)

    * mysql: Server: Performance Schema unspecified vulnerability (CPU Apr 2018) (CVE-2018-2846)

    * mysql: Server: DDL multiple unspecified vulnerabilities (CPU Jul 2018) (CVE-2018-3054, CVE-2018-3077)

    * mysql: Server: Security: Privileges unspecified vulnerability (CPU Jul 2018) (CVE-2018-3056)

    * mysql: MyISAM unspecified vulnerability (CPU Jul 2018) (CVE-2018-3058)

    * mysql: InnoDB multiple unspecified vulnerabilities (CPU Jul 2018) (CVE-2018-3060, CVE-2018-3064)

    * mysql: Server: DML multiple unspecified vulnerabilities (CPU Jul 2018) (CVE-2018-3061, CVE-2018-3065)

    * mysql: Server: Memcached unspecified vulnerability (CPU Jul 2018) (CVE-2018-3062)

    * mysql: Client mysqldump unspecified vulnerability (CPU Jul 2018) (CVE-2018-3070)

    * mysql: Audit Log unspecified vulnerability (CPU Jul 2018) (CVE-2018-3071)

    * mysql: Client programs unspecified vulnerability (CPU Jul 2018) (CVE-2018-3081)

    * mysql: Server: Parser multiple unspecified vulnerabilities (CPU Oct 2018) (CVE-2018-3133, CVE-2018-3155)

    * mysql: InnoDB multiple unspecified vulnerabilities (CPU Oct 2018) (CVE-2018-3143, CVE-2018-3156,     CVE-2018-3162, CVE-2018-3173, CVE-2018-3185, CVE-2018-3200, CVE-2018-3251, CVE-2018-3277, CVE-2018-3284)

    * mysql: Server: Security: Audit unspecified vulnerability (CPU Oct 2018) (CVE-2018-3144)

    * mysql: Server: Partition multiple unspecified vulnerabilities (CPU Oct 2018) (CVE-2018-3161,     CVE-2018-3171)

    * mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2018) (CVE-2018-3187)

    * mysql: Server: Merge unspecified vulnerability (CPU Oct 2018) (CVE-2018-3247)

    * mysql: Server: Memcached unspecified vulnerability (CPU Oct 2018) (CVE-2018-3276)

    * mysql: Server: RBR unspecified vulnerability (CPU Oct 2018) (CVE-2018-3278)

    * mysql: Server: Storage Engines unspecified vulnerability (CPU Oct 2018) (CVE-2018-3282)

    * mysql: Server: Logging unspecified vulnerability (CPU Oct 2018) (CVE-2018-3283)

    * mysql: pid file can be created in a world-writeable directory (CPU Apr 2018) (CVE-2018-2773)

    * mysql: Server: Options unspecified vulnerability (CPU Jul 2018) (CVE-2018-3066)

    * mysql: Init script calling kill with root privileges using pid from pidfile owned by mysql user (CPU Oct     2018) (CVE-2018-3174)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Oracle reports :

This Critical Patch Update contains 45 new security fixes for Oracle MySQL. 4 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials.

The version of MySQL running on the remote host is 5.7.x prior to 5.7.24 It is, therefore, affected by multiple vulnerabilities as noted in the October 2018 and July 2019 Critical Patch Update advisories. Please consult the CVRF details for the applicable CVEs for additional information.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
251421	Linux Distros Unpatched Vulnerability : CVE-2019-2731	Nessus	Misc.	medium
194018	RHEL 6 / 7 : rh-mysql57-mysql (RHSA-2018:3655)	Nessus	Red Hat Local Security Checks	high
126928	FreeBSD : MySQL -- Multiple vulerabilities (198e6220-ac8b-11e9-a1c7-b499baebfeaf)	Nessus	FreeBSD Local Security Checks	critical
118235	MySQL 5.7.x < 5.7.24 Multiple Vulnerabilities (Oct 2018 CPU) (Jul 2019 CPU)	Nessus	Databases	critical

Detections

Analytics

CVE-2019-2731

medium

Tenable Plugins

medium

high

critical

critical