The version of MySQL running on the remote host is 5.7.x prior to 5.7.19. It is, therefore, affected by multiple vulnerabilities :

  - An unspecified flaw exists in the UDF component that     allows an authenticated, remote attacker to cause a     denial of service condition. (CVE-2017-3529)

  - An unspecified flaw exists in the Memcached component     that allows an unauthenticated, remote attacker to     impact integrity and availability. (CVE-2017-3633)

  - Multiple unspecified flaws exist in the DML component     that allow an authenticated, remote attacker to cause a     denial of service condition. (CVE-2017-3634,     CVE-2017-3639, CVE-2017-3640, CVE-2017-3641,     CVE-2017-3643, CVE-2017-3644, CVE-2017-10296)

  - An unspecified flaw exists in the Connector/C and C API     components that allow an authenticated, remote attacker     to cause a denial of service condition. (CVE-2017-3635)

  - An unspecified flaw exists in the X Plugin component     that allows an authenticated, remote attacker to cause a     denial of service condition. (CVE-2017-3637)

  - Multiple unspecified flaws exist in the Optimizer     component that allow an authenticated, remote attacker     to cause a denial of service condition. (CVE-2017-3638,     CVE-2017-3642, CVE-2017-3645, CVE-2017-10279)

  - Multiple unspecified flaws exist in the Replication     component that allow an authenticated, remote attacker     to cause a denial of service condition. (CVE-2017-3647,     CVE-2017-3649)

  - An unspecified flaw exists in the Charsets component     that allows an authenticated, remote attacker to cause a     denial of service condition. (CVE-2017-3648)

  - An unspecified flaw exists in the C API component that     allows an unauthenticated, remote attacker to disclose     sensitive information. (CVE-2017-3650)

  - An unspecified flaw exists in the Client mysqldump     component that allows an authenticated, remote attacker     to impact integrity. (CVE-2017-3651)

  - Multiple unspecified flaws exist in the DDL component     that allow an authenticated, remote attacker to impact     confidentiality and integrity. (CVE-2017-3652,     CVE-2017-3653)

  - An unspecified flaw exists in the OpenSSL Encryption     component that allows an unauthenticated, remote     attacker to cause a denial of service condition.
    (CVE-2017-3731)

  - An unspecified flaw exists in the Stored Procedure     component that allows an authenticated, remote attacker     to cause a denial of service condition. (CVE-2017-10284)

  - An unspecified flaw exists in the InnoDB component that     allows an authenticated, remote attacker to cause a     denial of service condition or to modify the contents of     the MySQL database. (CVE-2017-10365)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Oracle reports :

This Critical Patch Update contains 45 new security fixes for Oracle MySQL. 4 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:2886 advisory.

  - mariadb, mysql: Incorrect input validation allowing code execution via mysqldump (CVE-2016-5483,     CVE-2017-3600)

  - mysql: Server: Replication  unspecified vulnerability (CPU Jan 2017) (CVE-2016-8327, CVE-2017-3256)

  - mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2017) (CVE-2017-3238)

  - mysql: Server: DML unspecified vulnerability (CPU Jan 2017) (CVE-2017-3244)

  - mysql: Server: Optimizer  unspecified vulnerability (CPU Jan 2017) (CVE-2017-3251)

  - mysql: Server: InnoDB unspecified vulnerability (CPU Jan 2017) (CVE-2017-3257)

  - mysql: Server: DDL unspecified vulnerability (CPU Jan 2017) (CVE-2017-3258)

  - mysql: Server: DDL  unspecified vulnerability (CPU Jan 2017) (CVE-2017-3273)

  - mysql: unrestricted mysqld_safe's ledir (CPU Jan 2017) (CVE-2017-3291)

  - mysql: Server: DML unspecified vulnerability (CPU Apr 2017) (CVE-2017-3308, CVE-2017-3331, CVE-2017-3456,     CVE-2017-3457, CVE-2017-3458)

  - mysql: Server: Optimizer unspecified vulnerability (CPU Apr 2017) (CVE-2017-3309, CVE-2017-3453,     CVE-2017-3459)

  - mysql: insecure error log file handling in mysqld_safe, incomplete CVE-2016-6664 fix (CPU Jan 2017)     (CVE-2017-3312)

  - mysql: Server: MyISAM unspecified vulnerability (CPU Jan 2017) (CVE-2017-3313)

  - mysql: Logging unspecified vulnerability (CPU Jan 2017) (CVE-2017-3317)

  - mysql: Server: Error Handling unspecified vulnerability (CPU Jan 2017) (CVE-2017-3318)

  - mysql: Server: X Plugin  unspecified vulnerability (CPU Jan 2017) (CVE-2017-3319)

  - mysql: Server: Security: Encryption  unspecified vulnerability (CPU Jan 2017) (CVE-2017-3320)

  - mysql: Server: Memcached unspecified vulnerability (CPU Apr 2017) (CVE-2017-3450)

  - mysql: Server: InnoDB unspecified vulnerability (CPU Apr 2017) (CVE-2017-3454)

  - mysql: Server: Security: Privileges unspecified vulnerability (CPU Apr 2017) (CVE-2017-3455,     CVE-2017-3461, CVE-2017-3462, CVE-2017-3463, CVE-2017-3465)

  - mysql: Server: Audit Plug-in unspecified vulnerability (CPU Apr 2017) (CVE-2017-3460)

  - mysql: Server: DDL unspecified vulnerability (CPU Apr 2017) (CVE-2017-3464)

  - mysql: Server: C API unspecified vulnerability (CPU Apr 2017) (CVE-2017-3467)

  - mysql: Server: Security: Encryption unspecified vulnerability (CPU Apr 2017) (CVE-2017-3468)

  - mysql: Server: UDF unspecified vulnerability (CPU Jul 2017) (CVE-2017-3529)

  - mysql: integer underflow in get_56_lenc_string() leading to DoS (CPU Apr 2017) (CVE-2017-3599)

  - mysql: Server: Memcached unspecified vulnerability (CPU Jul 2017) (CVE-2017-3633)

  - mysql: Server: DML unspecified vulnerability (CPU Jul 2017) (CVE-2017-3634, CVE-2017-3639, CVE-2017-3640,     CVE-2017-3641, CVE-2017-3643, CVE-2017-3644)

  - mysql: X Plugin unspecified vulnerability (CPU Jul 2017) (CVE-2017-3637, CVE-2017-3646)

  - mysql: Server: Optimizer unspecified vulnerability (CPU Jul 2017) (CVE-2017-3638, CVE-2017-3642,     CVE-2017-3645)

  - mysql: Server: Replication unspecified vulnerability (CPU Jul 2017) (CVE-2017-3647, CVE-2017-3649)

  - mysql: Server: Charsets unspecified vulnerability (CPU Jul 2017) (CVE-2017-3648)

  - mysql: C API unspecified vulnerability (CPU Jul 2017) (CVE-2017-3650)

  - mysql: Client mysqldump unspecified vulnerability (CPU Jul 2017) (CVE-2017-3651)

  - mysql: Server: DDL unspecified vulnerability (CPU Jul 2017) (CVE-2017-3652, CVE-2017-3653)

  - mysql: Server: Security: Privileges unspecified vulnerability (CPU Jul 2019) (CVE-2019-2730)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
101821	MySQL 5.7.x < 5.7.19 Multiple Vulnerabilities (Jul 2017 CPU) (Oct 2017 CPU) (Jul 2019 CPU)	Nessus	Databases	7/19/2017	7/18/2019	medium
126928	FreeBSD : MySQL -- Multiple vulerabilities (198e6220-ac8b-11e9-a1c7-b499baebfeaf)	Nessus	FreeBSD Local Security Checks	7/23/2019	12/7/2022	critical
194054	RHEL 6 / 7 : rh-mysql57-mysql (RHSA-2017:2886)	Nessus	Red Hat Local Security Checks	4/27/2024	4/27/2024	medium

Detections

Analytics

Plugins Search

medium

critical

medium