Amazon Linux AMI update for mysql57

1) Improper input validation

EUVDB-ID: #VU28731

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2019-2911

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote privileged user to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Information Schema component in MySQL Server. A remote privileged user can exploit this vulnerability to gain access to sensitive information.

Mitigation

Update the affected packages:

i686:
    mysql57-errmsg-5.7.28-1.14.amzn1.i686
    mysql57-test-5.7.28-1.14.amzn1.i686
    mysql57-debuginfo-5.7.28-1.14.amzn1.i686
    mysql57-devel-5.7.28-1.14.amzn1.i686
    mysql57-embedded-5.7.28-1.14.amzn1.i686
    mysql57-server-5.7.28-1.14.amzn1.i686
    mysql57-common-5.7.28-1.14.amzn1.i686
    mysql57-libs-5.7.28-1.14.amzn1.i686
    mysql57-5.7.28-1.14.amzn1.i686
    mysql57-embedded-devel-5.7.28-1.14.amzn1.i686

src:
    mysql57-5.7.28-1.14.amzn1.src

x86_64:
    mysql57-libs-5.7.28-1.14.amzn1.x86_64
    mysql57-common-5.7.28-1.14.amzn1.x86_64
    mysql57-server-5.7.28-1.14.amzn1.x86_64
    mysql57-embedded-devel-5.7.28-1.14.amzn1.x86_64
    mysql57-devel-5.7.28-1.14.amzn1.x86_64
    mysql57-errmsg-5.7.28-1.14.amzn1.x86_64
    mysql57-5.7.28-1.14.amzn1.x86_64
    mysql57-debuginfo-5.7.28-1.14.amzn1.x86_64
    mysql57-test-5.7.28-1.14.amzn1.x86_64
    mysql57-embedded-5.7.28-1.14.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:*

External links

https://alas.aws.amazon.com/ALAS-2020-1333.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Improper input validation

EUVDB-ID: #VU28709

Risk: Medium

CVSSv4.0: 4.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2019-2914

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote authenticated user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server: Security: Encryption component in MySQL Server. A remote authenticated user can exploit this vulnerability to perform a denial of service (DoS) attack.

Mitigation

Update the affected packages:

i686:
    mysql57-errmsg-5.7.28-1.14.amzn1.i686
    mysql57-test-5.7.28-1.14.amzn1.i686
    mysql57-debuginfo-5.7.28-1.14.amzn1.i686
    mysql57-devel-5.7.28-1.14.amzn1.i686
    mysql57-embedded-5.7.28-1.14.amzn1.i686
    mysql57-server-5.7.28-1.14.amzn1.i686
    mysql57-common-5.7.28-1.14.amzn1.i686
    mysql57-libs-5.7.28-1.14.amzn1.i686
    mysql57-5.7.28-1.14.amzn1.i686
    mysql57-embedded-devel-5.7.28-1.14.amzn1.i686

src:
    mysql57-5.7.28-1.14.amzn1.src

x86_64:
    mysql57-libs-5.7.28-1.14.amzn1.x86_64
    mysql57-common-5.7.28-1.14.amzn1.x86_64
    mysql57-server-5.7.28-1.14.amzn1.x86_64
    mysql57-embedded-devel-5.7.28-1.14.amzn1.x86_64
    mysql57-devel-5.7.28-1.14.amzn1.x86_64
    mysql57-errmsg-5.7.28-1.14.amzn1.x86_64
    mysql57-5.7.28-1.14.amzn1.x86_64
    mysql57-debuginfo-5.7.28-1.14.amzn1.x86_64
    mysql57-test-5.7.28-1.14.amzn1.x86_64
    mysql57-embedded-5.7.28-1.14.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:*

External links

https://alas.aws.amazon.com/ALAS-2020-1333.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Improper input validation

EUVDB-ID: #VU28727

Risk: Low

CVSSv4.0: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2019-2938

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote privileged user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the InnoDB component in MySQL Server. A remote privileged user can exploit this vulnerability to perform a denial of service (DoS) attack.

Mitigation

Update the affected packages:

i686:
    mysql57-errmsg-5.7.28-1.14.amzn1.i686
    mysql57-test-5.7.28-1.14.amzn1.i686
    mysql57-debuginfo-5.7.28-1.14.amzn1.i686
    mysql57-devel-5.7.28-1.14.amzn1.i686
    mysql57-embedded-5.7.28-1.14.amzn1.i686
    mysql57-server-5.7.28-1.14.amzn1.i686
    mysql57-common-5.7.28-1.14.amzn1.i686
    mysql57-libs-5.7.28-1.14.amzn1.i686
    mysql57-5.7.28-1.14.amzn1.i686
    mysql57-embedded-devel-5.7.28-1.14.amzn1.i686

src:
    mysql57-5.7.28-1.14.amzn1.src

x86_64:
    mysql57-libs-5.7.28-1.14.amzn1.x86_64
    mysql57-common-5.7.28-1.14.amzn1.x86_64
    mysql57-server-5.7.28-1.14.amzn1.x86_64
    mysql57-embedded-devel-5.7.28-1.14.amzn1.x86_64
    mysql57-devel-5.7.28-1.14.amzn1.x86_64
    mysql57-errmsg-5.7.28-1.14.amzn1.x86_64
    mysql57-5.7.28-1.14.amzn1.x86_64
    mysql57-debuginfo-5.7.28-1.14.amzn1.x86_64
    mysql57-test-5.7.28-1.14.amzn1.x86_64
    mysql57-embedded-5.7.28-1.14.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:*

External links

https://alas.aws.amazon.com/ALAS-2020-1333.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Improper input validation

EUVDB-ID: #VU28707

Risk: Medium

CVSSv4.0: 4.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2019-2946

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote authenticated user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server: PS component in MySQL Server. A remote authenticated user can exploit this vulnerability to perform a denial of service (DoS) attack.

Mitigation

Update the affected packages:

i686:
    mysql57-errmsg-5.7.28-1.14.amzn1.i686
    mysql57-test-5.7.28-1.14.amzn1.i686
    mysql57-debuginfo-5.7.28-1.14.amzn1.i686
    mysql57-devel-5.7.28-1.14.amzn1.i686
    mysql57-embedded-5.7.28-1.14.amzn1.i686
    mysql57-server-5.7.28-1.14.amzn1.i686
    mysql57-common-5.7.28-1.14.amzn1.i686
    mysql57-libs-5.7.28-1.14.amzn1.i686
    mysql57-5.7.28-1.14.amzn1.i686
    mysql57-embedded-devel-5.7.28-1.14.amzn1.i686

src:
    mysql57-5.7.28-1.14.amzn1.src

x86_64:
    mysql57-libs-5.7.28-1.14.amzn1.x86_64
    mysql57-common-5.7.28-1.14.amzn1.x86_64
    mysql57-server-5.7.28-1.14.amzn1.x86_64
    mysql57-embedded-devel-5.7.28-1.14.amzn1.x86_64
    mysql57-devel-5.7.28-1.14.amzn1.x86_64
    mysql57-errmsg-5.7.28-1.14.amzn1.x86_64
    mysql57-5.7.28-1.14.amzn1.x86_64
    mysql57-debuginfo-5.7.28-1.14.amzn1.x86_64
    mysql57-test-5.7.28-1.14.amzn1.x86_64
    mysql57-embedded-5.7.28-1.14.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:*

External links

https://alas.aws.amazon.com/ALAS-2020-1333.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Improper input validation

EUVDB-ID: #VU28725

Risk: Medium

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2019-2960

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote privileged user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server: Replication component in MySQL Server. A remote privileged user can exploit this vulnerability to perform a denial of service (DoS) attack.

Mitigation

Update the affected packages:

i686:
    mysql57-errmsg-5.7.28-1.14.amzn1.i686
    mysql57-test-5.7.28-1.14.amzn1.i686
    mysql57-debuginfo-5.7.28-1.14.amzn1.i686
    mysql57-devel-5.7.28-1.14.amzn1.i686
    mysql57-embedded-5.7.28-1.14.amzn1.i686
    mysql57-server-5.7.28-1.14.amzn1.i686
    mysql57-common-5.7.28-1.14.amzn1.i686
    mysql57-libs-5.7.28-1.14.amzn1.i686
    mysql57-5.7.28-1.14.amzn1.i686
    mysql57-embedded-devel-5.7.28-1.14.amzn1.i686

src:
    mysql57-5.7.28-1.14.amzn1.src

x86_64:
    mysql57-libs-5.7.28-1.14.amzn1.x86_64
    mysql57-common-5.7.28-1.14.amzn1.x86_64
    mysql57-server-5.7.28-1.14.amzn1.x86_64
    mysql57-embedded-devel-5.7.28-1.14.amzn1.x86_64
    mysql57-devel-5.7.28-1.14.amzn1.x86_64
    mysql57-errmsg-5.7.28-1.14.amzn1.x86_64
    mysql57-5.7.28-1.14.amzn1.x86_64
    mysql57-debuginfo-5.7.28-1.14.amzn1.x86_64
    mysql57-test-5.7.28-1.14.amzn1.x86_64
    mysql57-embedded-5.7.28-1.14.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:*

External links

https://alas.aws.amazon.com/ALAS-2020-1333.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Improper input validation

EUVDB-ID: #VU28706

Risk: Medium

CVSSv4.0: 4.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2019-2974

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote authenticated user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server: Optimizer component in MySQL Server. A remote authenticated user can exploit this vulnerability to perform a denial of service (DoS) attack.

Mitigation

Update the affected packages:

i686:
    mysql57-errmsg-5.7.28-1.14.amzn1.i686
    mysql57-test-5.7.28-1.14.amzn1.i686
    mysql57-debuginfo-5.7.28-1.14.amzn1.i686
    mysql57-devel-5.7.28-1.14.amzn1.i686
    mysql57-embedded-5.7.28-1.14.amzn1.i686
    mysql57-server-5.7.28-1.14.amzn1.i686
    mysql57-common-5.7.28-1.14.amzn1.i686
    mysql57-libs-5.7.28-1.14.amzn1.i686
    mysql57-5.7.28-1.14.amzn1.i686
    mysql57-embedded-devel-5.7.28-1.14.amzn1.i686

src:
    mysql57-5.7.28-1.14.amzn1.src

x86_64:
    mysql57-libs-5.7.28-1.14.amzn1.x86_64
    mysql57-common-5.7.28-1.14.amzn1.x86_64
    mysql57-server-5.7.28-1.14.amzn1.x86_64
    mysql57-embedded-devel-5.7.28-1.14.amzn1.x86_64
    mysql57-devel-5.7.28-1.14.amzn1.x86_64
    mysql57-errmsg-5.7.28-1.14.amzn1.x86_64
    mysql57-5.7.28-1.14.amzn1.x86_64
    mysql57-debuginfo-5.7.28-1.14.amzn1.x86_64
    mysql57-test-5.7.28-1.14.amzn1.x86_64
    mysql57-embedded-5.7.28-1.14.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:*

External links

https://alas.aws.amazon.com/ALAS-2020-1333.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Improper input validation

EUVDB-ID: #VU28713

Risk: Medium

CVSSv4.0: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2019-2993

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote authenticated user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server: C API component in MySQL Server. A remote authenticated user can exploit this vulnerability to perform a denial of service (DoS) attack.

Mitigation

Update the affected packages:

i686:
    mysql57-errmsg-5.7.28-1.14.amzn1.i686
    mysql57-test-5.7.28-1.14.amzn1.i686
    mysql57-debuginfo-5.7.28-1.14.amzn1.i686
    mysql57-devel-5.7.28-1.14.amzn1.i686
    mysql57-embedded-5.7.28-1.14.amzn1.i686
    mysql57-server-5.7.28-1.14.amzn1.i686
    mysql57-common-5.7.28-1.14.amzn1.i686
    mysql57-libs-5.7.28-1.14.amzn1.i686
    mysql57-5.7.28-1.14.amzn1.i686
    mysql57-embedded-devel-5.7.28-1.14.amzn1.i686

src:
    mysql57-5.7.28-1.14.amzn1.src

x86_64:
    mysql57-libs-5.7.28-1.14.amzn1.x86_64
    mysql57-common-5.7.28-1.14.amzn1.x86_64
    mysql57-server-5.7.28-1.14.amzn1.x86_64
    mysql57-embedded-devel-5.7.28-1.14.amzn1.x86_64
    mysql57-devel-5.7.28-1.14.amzn1.x86_64
    mysql57-errmsg-5.7.28-1.14.amzn1.x86_64
    mysql57-5.7.28-1.14.amzn1.x86_64
    mysql57-debuginfo-5.7.28-1.14.amzn1.x86_64
    mysql57-test-5.7.28-1.14.amzn1.x86_64
    mysql57-embedded-5.7.28-1.14.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:*

External links

https://alas.aws.amazon.com/ALAS-2020-1333.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

Risk	Medium
Patch available	YES
Number of vulnerabilities	7
CVE-ID	CVE-2019-2911 CVE-2019-2914 CVE-2019-2938 CVE-2019-2946 CVE-2019-2960 CVE-2019-2974 CVE-2019-2993
CWE-ID	CWE-125
Exploitation vector	Network
Public exploit	N/A
Vulnerable software	Amazon Linux AMI Operating systems & Components / Operating system
Vendor	Amazon Web Services