Sigurnosni nedostaci programskih paketa rh-mariadb102-mariadb i rh-mariadb102

—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA256

=====================================================================
Red Hat Security Advisory

Synopsis: Moderate: rh-mariadb102-mariadb and rh-mariadb102-galera security and bug fix update
Advisory ID: RHSA-2019:1258-01
Product: Red Hat Software Collections
Advisory URL: https://access.redhat.com/errata/RHSA-2019:1258
Issue date: 2019-05-21
CVE Names: CVE-2017-10268 CVE-2017-10378 CVE-2017-15365
CVE-2018-2562 CVE-2018-2612 CVE-2018-2622
CVE-2018-2640 CVE-2018-2665 CVE-2018-2668
CVE-2018-2755 CVE-2018-2759 CVE-2018-2761
CVE-2018-2766 CVE-2018-2771 CVE-2018-2777
CVE-2018-2781 CVE-2018-2782 CVE-2018-2784
CVE-2018-2786 CVE-2018-2787 CVE-2018-2810
CVE-2018-2813 CVE-2018-2817 CVE-2018-2819
CVE-2018-3058 CVE-2018-3060 CVE-2018-3063
CVE-2018-3064 CVE-2018-3066 CVE-2018-3081
CVE-2018-3133 CVE-2018-3143 CVE-2018-3156
CVE-2018-3162 CVE-2018-3173 CVE-2018-3174
CVE-2018-3185 CVE-2018-3200 CVE-2018-3251
CVE-2018-3277 CVE-2018-3282 CVE-2018-3284
CVE-2019-2455 CVE-2019-2503 CVE-2019-2510
CVE-2019-2537
=====================================================================

1. Summary:

An update for rh-mariadb102-mariadb and rh-mariadb102-galera is now
available for Red Hat Software Collections.

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) – x86_64
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) – aarch64, ppc64le, s390x, x86_64
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4) – ppc64le, s390x, x86_64
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) – ppc64le, s390x, x86_64
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) – ppc64le, s390x, x86_64
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) – x86_64
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) – x86_64

3. Description:

MariaDB is a multi-user, multi-threaded SQL database server. For all
practical purposes, MariaDB is binary-compatible with MySQL.

The following packages have been upgraded to a later upstream version:
rh-mariadb102-mariadb (10.2.22), rh-mariadb102-galera (25.3.25).

Security Fix(es):

* mysql: Server: Replication unspecified vulnerability (CPU Oct 2017)
(CVE-2017-10268)

* mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2017)
(CVE-2017-10378)

* mariadb: Replication in sql/event_data_objects.cc occurs before ACL
checks (CVE-2017-15365)

* mysql: Server: Partition unspecified vulnerability (CPU Jan 2018)
(CVE-2018-2562)

* mysql: InnoDB unspecified vulnerability (CPU Jan 2018) (CVE-2018-2612)

* mysql: Server: DDL unspecified vulnerability (CPU Jan 2018)
(CVE-2018-2622)

* mysql: Server: Optimizer multiple unspecified vulnerabilities (CPU Jan
2018) (CVE-2018-2640, CVE-2018-2665, CVE-2018-2668)

* mysql: Server: Replication unspecified vulnerability (CPU Apr 2018)
(CVE-2018-2755)

* mysql: InnoDB multiple unspecified vulnerabilities (CPU Apr 2018)
(CVE-2018-2759, CVE-2018-2766, CVE-2018-2777, CVE-2018-2782, CVE-2018-2784,
CVE-2018-2786, CVE-2018-2787, CVE-2018-2810, CVE-2018-2819)

* mysql: Client programs unspecified vulnerability (CPU Apr 2018)
(CVE-2018-2761)

* mysql: Server: Locking unspecified vulnerability (CPU Apr 2018)
(CVE-2018-2771)

* mysql: Server: Optimizer unspecified vulnerability (CPU Apr 2018)
(CVE-2018-2781)

* mysql: Server: DDL multiple unspecified vulnerabilities (CPU Apr 2018)
(CVE-2018-2813, CVE-2018-2817)

* mysql: MyISAM unspecified vulnerability (CPU Jul 2018) (CVE-2018-3058)

* mysql: InnoDB multiple unspecified vulnerabilities (CPU Jul 2018)
(CVE-2018-3060, CVE-2018-3064)

* mysql: Server: Security: Privileges unspecified vulnerability (CPU Jul
2018) (CVE-2018-3063)

* mysql: Client programs unspecified vulnerability (CPU Jul 2018)
(CVE-2018-3081)

* mysql: Server: Parser unspecified vulnerability (CPU Oct 2018)
(CVE-2018-3133)

* mysql: InnoDB multiple unspecified vulnerabilities (CPU Oct 2018)
(CVE-2018-3143, CVE-2018-3156, CVE-2018-3162, CVE-2018-3173, CVE-2018-3185,
CVE-2018-3200, CVE-2018-3251, CVE-2018-3277, CVE-2018-3284)

* mysql: Server: Storage Engines unspecified vulnerability (CPU Oct 2018)
(CVE-2018-3282)

* mysql: Server: Parser unspecified vulnerability (CPU Jan 2019)
(CVE-2019-2455)

* mysql: Server: Connection Handling unspecified vulnerability (CPU Jan
2019) (CVE-2019-2503)

* mysql: InnoDB unspecified vulnerability (CPU Jan 2019) (CVE-2019-2510)

* mysql: Server: DDL unspecified vulnerability (CPU Jan 2019)
(CVE-2019-2537)

* mysql: Server: Options unspecified vulnerability (CPU Jul 2018)
(CVE-2018-3066)

* mysql: Init script calling kill with root privileges using pid from
pidfile owned by mysql user (CPU Oct 2018) (CVE-2018-3174)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

Bug Fix(es):

* SELinux blocks working in /tmp directory for wsrep_recover_position
function (BZ#1701252)

* mysql faces a bug which prevents bacula from functioning (BZ#1701254)

* GSSAPI module build fix – backport request (BZ#1701257)

* Deadlock in RNG initialization in the FIPS mode on some circumstances
(BZ#1701258)

* Use appropriate version of Galera (BZ#1704162)

* Encountered WSREP: BF lock wait long for trx MariaDB 10.2.8 (BZ#1709233)

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MariaDB server daemon (mysqld) will be
restarted automatically.

5. Bugs fixed (https://bugzilla.redhat.com/):

1503656 – CVE-2017-10268 mysql: Server: Replication unspecified vulnerability (CPU Oct 2017)
1503684 – CVE-2017-10378 mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2017)
1524234 – CVE-2017-15365 mariadb: Replication in sql/event_data_objects.cc occurs before ACL checks
1535484 – CVE-2018-2562 mysql: Server: Partition unspecified vulnerability (CPU Jan 2018)
1535497 – CVE-2018-2612 mysql: InnoDB unspecified vulnerability (CPU Jan 2018)
1535499 – CVE-2018-2622 mysql: Server: DDL unspecified vulnerability (CPU Jan 2018)
1535500 – CVE-2018-2640 mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2018)
1535504 – CVE-2018-2665 mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2018)
1535506 – CVE-2018-2668 mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2018)
1568921 – CVE-2018-2755 mysql: Server: Replication unspecified vulnerability (CPU Apr 2018)
1568923 – CVE-2018-2759 mysql: InnoDB unspecified vulnerability (CPU Apr 2018)
1568924 – CVE-2018-2761 mysql: Client programs unspecified vulnerability (CPU Apr 2018)
1568926 – CVE-2018-2766 mysql: InnoDB unspecified vulnerability (CPU Apr 2018)
1568931 – CVE-2018-2771 mysql: Server: Locking unspecified vulnerability (CPU Apr 2018)
1568937 – CVE-2018-2777 mysql: InnoDB unspecified vulnerability (CPU Apr 2018)
1568942 – CVE-2018-2781 mysql: Server: Optimizer unspecified vulnerability (CPU Apr 2018)
1568943 – CVE-2018-2782 mysql: InnoDB unspecified vulnerability (CPU Apr 2018)
1568944 – CVE-2018-2784 mysql: InnoDB unspecified vulnerability (CPU Apr 2018)
1568945 – CVE-2018-2786 mysql: InnoDB unspecified vulnerability (CPU Apr 2018)
1568946 – CVE-2018-2787 mysql: InnoDB unspecified vulnerability (CPU Apr 2018)
1568949 – CVE-2018-2810 mysql: InnoDB unspecified vulnerability (CPU Apr 2018)
1568951 – CVE-2018-2813 mysql: Server: DDL unspecified vulnerability (CPU Apr 2018)
1568954 – CVE-2018-2817 mysql: Server: DDL unspecified vulnerability (CPU Apr 2018)
1568956 – CVE-2018-2819 mysql: InnoDB unspecified vulnerability (CPU Apr 2018)
1602356 – CVE-2018-3058 mysql: MyISAM unspecified vulnerability (CPU Jul 2018)
1602357 – CVE-2018-3060 mysql: InnoDB unspecified vulnerability (CPU Jul 2018)
1602363 – CVE-2018-3063 mysql: Server: Security: Privileges unspecified vulnerability (CPU Jul 2018)
1602364 – CVE-2018-3064 mysql: InnoDB unspecified vulnerability (CPU Jul 2018)
1602366 – CVE-2018-3066 mysql: Server: Options unspecified vulnerability (CPU Jul 2018)
1602424 – CVE-2018-3081 mysql: Client programs unspecified vulnerability (CPU Jul 2018)
1640308 – CVE-2018-3200 mysql: InnoDB unspecified vulnerability (CPU Oct 2018)
1640310 – CVE-2018-3284 mysql: InnoDB unspecified vulnerability (CPU Oct 2018)
1640312 – CVE-2018-3173 mysql: InnoDB unspecified vulnerability (CPU Oct 2018)
1640316 – CVE-2018-3162 mysql: InnoDB unspecified vulnerability (CPU Oct 2018)
1640318 – CVE-2018-3156 mysql: InnoDB unspecified vulnerability (CPU Oct 2018)
1640321 – CVE-2018-3174 mysql: Init script calling kill with root privileges using pid from pidfile owned by mysql user (CPU Oct 2018)
1640322 – CVE-2018-3282 mysql: Server: Storage Engines unspecified vulnerability (CPU Oct 2018)
1640325 – CVE-2018-3277 mysql: InnoDB unspecified vulnerability (CPU Oct 2018)
1640331 – CVE-2018-3133 mysql: Server: Parser unspecified vulnerability (CPU Oct 2018)
1640332 – CVE-2018-3143 mysql: InnoDB unspecified vulnerability (CPU Oct 2018)
1640335 – CVE-2018-3251 mysql: InnoDB unspecified vulnerability (CPU Oct 2018)
1640337 – CVE-2018-3185 mysql: InnoDB unspecified vulnerability (CPU Oct 2018)
1666742 – CVE-2019-2455 mysql: Server: Parser unspecified vulnerability (CPU Jan 2019)
1666749 – CVE-2019-2503 mysql: Server: Connection Handling unspecified vulnerability (CPU Jan 2019)
1666751 – CVE-2019-2510 mysql: InnoDB unspecified vulnerability (CPU Jan 2019)
1666763 – CVE-2019-2537 mysql: Server: DDL unspecified vulnerability (CPU Jan 2019)
1701252 – SELinux blocks working in /tmp directory for wsrep_recover_position function [3.2.z]
1701257 – GSSAPI module build fix – backport request [3.2.z]
1704162 – Use appropriate version of Galera [3.2.z]
1709233 – Encountered WSREP: BF lock wait long for trx MariaDB 10.2.8 [rhscl-3.2.z]

6. Package List:

Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6):

Source:
rh-mariadb102-galera-25.3.25-1.el6.src.rpm
rh-mariadb102-mariadb-10.2.22-1.el6.src.rpm

x86_64:
rh-mariadb102-galera-25.3.25-1.el6.x86_64.rpm
rh-mariadb102-galera-debuginfo-25.3.25-1.el6.x86_64.rpm
rh-mariadb102-mariadb-10.2.22-1.el6.x86_64.rpm
rh-mariadb102-mariadb-backup-10.2.22-1.el6.x86_64.rpm
rh-mariadb102-mariadb-backup-syspaths-10.2.22-1.el6.x86_64.rpm
rh-mariadb102-mariadb-bench-10.2.22-1.el6.x86_64.rpm
rh-mariadb102-mariadb-common-10.2.22-1.el6.x86_64.rpm
rh-mariadb102-mariadb-config-10.2.22-1.el6.x86_64.rpm
rh-mariadb102-mariadb-config-syspaths-10.2.22-1.el6.x86_64.rpm
rh-mariadb102-mariadb-debuginfo-10.2.22-1.el6.x86_64.rpm
rh-mariadb102-mariadb-devel-10.2.22-1.el6.x86_64.rpm
rh-mariadb102-mariadb-errmsg-10.2.22-1.el6.x86_64.rpm
rh-mariadb102-mariadb-gssapi-client-10.2.22-1.el6.x86_64.rpm
rh-mariadb102-mariadb-gssapi-server-10.2.22-1.el6.x86_64.rpm
rh-mariadb102-mariadb-oqgraph-engine-10.2.22-1.el6.x86_64.rpm
rh-mariadb102-mariadb-server-10.2.22-1.el6.x86_64.rpm
rh-mariadb102-mariadb-server-galera-10.2.22-1.el6.x86_64.rpm
rh-mariadb102-mariadb-server-galera-syspaths-10.2.22-1.el6.x86_64.rpm
rh-mariadb102-mariadb-server-syspaths-10.2.22-1.el6.x86_64.rpm
rh-mariadb102-mariadb-server-utils-10.2.22-1.el6.x86_64.rpm
rh-mariadb102-mariadb-server-utils-syspaths-10.2.22-1.el6.x86_64.rpm
rh-mariadb102-mariadb-syspaths-10.2.22-1.el6.x86_64.rpm
rh-mariadb102-mariadb-test-10.2.22-1.el6.x86_64.rpm

Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6):

Source:
rh-mariadb102-galera-25.3.25-1.el6.src.rpm
rh-mariadb102-mariadb-10.2.22-1.el6.src.rpm

Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7):