RHEL 7 : mariadb (RHSA-2015:1665) (BACKRONYM)

Medium Nessus Plugin ID 85616

Synopsis

The remote Red Hat host is missing one or more security updates.

Description

Updated mariadb packages that fix several security issues are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL.

It was found that the MySQL client library permitted but did not require a client to use SSL/TLS when establishing a secure connection to a MySQL server using the '--ssl' option. A man-in-the-middle attacker could use this flaw to strip the SSL/TLS protection from a connection between a client and a server. (CVE-2015-3152)

This update fixes several vulnerabilities in the MariaDB database server. Information about these flaws can be found on the Oracle Critical Patch Update Advisory page, listed in the References section.
(CVE-2015-0501, CVE-2015-2568, CVE-2015-0499, CVE-2015-2571, CVE-2015-0433, CVE-2015-0441, CVE-2015-0505, CVE-2015-2573, CVE-2015-2582, CVE-2015-2620, CVE-2015-2643, CVE-2015-2648, CVE-2015-4737, CVE-2015-4752, CVE-2015-4757)

These updated packages upgrade MariaDB to version 5.5.44. Refer to the MariaDB Release Notes listed in the References section for a complete list of changes.

All MariaDB users should upgrade to these updated packages, which correct these issues. After installing this update, the MariaDB server daemon (mysqld) will be restarted automatically.

Solution

Update the affected packages.

See Also

http://www.nessus.org/u?ef68d9ef

http://www.nessus.org/u?73eb3b44

https://mariadb.com/kb/en/library/mariadb-5544-release-notes/

https://access.redhat.com/errata/RHSA-2015:1665

https://access.redhat.com/security/cve/cve-2015-0433

https://access.redhat.com/security/cve/cve-2015-0441

https://access.redhat.com/security/cve/cve-2015-0499

https://access.redhat.com/security/cve/cve-2015-0501

https://access.redhat.com/security/cve/cve-2015-0505

https://access.redhat.com/security/cve/cve-2015-2568

https://access.redhat.com/security/cve/cve-2015-2571

https://access.redhat.com/security/cve/cve-2015-2573

https://access.redhat.com/security/cve/cve-2015-2582

https://access.redhat.com/security/cve/cve-2015-2620

https://access.redhat.com/security/cve/cve-2015-2643

https://access.redhat.com/security/cve/cve-2015-2648

https://access.redhat.com/security/cve/cve-2015-3152

https://access.redhat.com/security/cve/cve-2015-4737

https://access.redhat.com/security/cve/cve-2015-4752

https://access.redhat.com/security/cve/cve-2015-4757

https://access.redhat.com/security/cve/cve-2015-4864

Plugin Details

Severity: Medium

ID: 85616

File Name: redhat-RHSA-2015-1665.nasl

Version: 2.16

Type: local

Agent: unix

Published: 2015/08/25

Updated: 2018/11/26

Dependencies: 12634

Risk Information

Risk Factor: Medium

CVSS v2.0

Base Score: 5.7

Temporal Score: 4.2

Vector: CVSS2#AV:N/AC:M/Au:M/C:N/I:N/A:C

Temporal Vector: CVSS2#E:U/RL:OF/RC:C

CVSS v3.0

Base Score: 5.9

Temporal Score: 5.2

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:redhat:enterprise_linux:mariadb, p-cpe:/a:redhat:enterprise_linux:mariadb-bench, p-cpe:/a:redhat:enterprise_linux:mariadb-debuginfo, p-cpe:/a:redhat:enterprise_linux:mariadb-devel, p-cpe:/a:redhat:enterprise_linux:mariadb-embedded, p-cpe:/a:redhat:enterprise_linux:mariadb-embedded-devel, p-cpe:/a:redhat:enterprise_linux:mariadb-libs, p-cpe:/a:redhat:enterprise_linux:mariadb-server, p-cpe:/a:redhat:enterprise_linux:mariadb-test, cpe:/o:redhat:enterprise_linux:7, cpe:/o:redhat:enterprise_linux:7.1, cpe:/o:redhat:enterprise_linux:7.2, cpe:/o:redhat:enterprise_linux:7.3, cpe:/o:redhat:enterprise_linux:7.4, cpe:/o:redhat:enterprise_linux:7.5, cpe:/o:redhat:enterprise_linux:7.6

Exploit Available: false

Exploit Ease: No known exploits are available

Patch Publication Date: 2015/08/24

Reference Information

CVE: CVE-2015-0433, CVE-2015-0441, CVE-2015-0499, CVE-2015-0501, CVE-2015-0505, CVE-2015-2568, CVE-2015-2571, CVE-2015-2573, CVE-2015-2582, CVE-2015-2620, CVE-2015-2643, CVE-2015-2648, CVE-2015-3152, CVE-2015-4737, CVE-2015-4752, CVE-2015-4757, CVE-2015-4864

RHSA: 2015:1665