SB2018053109 - OpenSUSE Linux update for perl-DBD-mysql

Description

This security bulletin contains information about 3 secuirty vulnerabilities.

1) Man-in-the-middle attack (CVE-ID: CVE-2017-10788)

The vulnerability allows a remote attacker to conduct man-in-the-middle attack on the target system.

The vulnerability exists due to use-after-free error when improper certificate validation. A remote attacker can conduct man-in-the-middle attack, intercept of the communication channel between the affected app, trigger (1) certain error responses from a MySQL server or (2) a loss of a network connection to a MySQL server and cause the service to crash.

2) Man-in-the-middle attack (CVE-ID: CVE-2017-10789)

The vulnerability allows a remote attacker to conduct man-in-the-middle attack on the target system.

The vulnerability exists due to use of the mysql_ssl=1 setting to mean that SSL is optional (even though this setting's documentation has a "your communication with the server will be encrypted" statement). A remote attacker can conduct man-in-the-middle attack, intercept of the communication channel between the affected app and spoof servers via a cleartext-downgrade attack.

3) Man-in-the-middle attack (CVE-ID: CVE-2015-3152)

The vulnerability allows a remote attacker to conduct man-in-the-middle attack on the target system.

The vulnerability exists due to use of the --ssl option to mean that SSL is optional. A remote attacker can conduct man-in-the-middle attack, intercept of the communication channel between the affected app and spoof servers via a cleartext-downgrade attack, aka a "BACKRONYM" attack.

Remediation

Install update from vendor's website.

References

• https://lists.opensuse.org/opensuse-security-announce/2018-05/msg00113.html