[Bug 1851019] New: CVE-2020-2875mysql-connector-java: allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors which could result in unauthorized update, insert or delete

https://bugzilla.redhat.com/show_bug.cgi?id=1851019

            Bug ID: 1851019
           Summary: CVE-2020-2875mysql-connector-java: allows
                    unauthenticated attacker with network access via
                    multiple protocols to compromise MySQL Connectors
                    which could result in unauthorized update, insert or
                    delete
           Product: Security Response
          Hardware: All
                OS: Linux
            Status: NEW
         Component: vulnerability
          Keywords: Security
          Severity: low
          Priority: low
          Assignee: security-response-team(a)redhat.com
          Reporter: mkaplan(a)redhat.com
                CC: aboyko(a)redhat.com, aileenc(a)redhat.com,
                    akoufoud(a)redhat.com, alazarot(a)redhat.com,
                    almorale(a)redhat.com, anstephe(a)redhat.com,
                    asoldano(a)redhat.com, atangrin(a)redhat.com,
                    avibelli(a)redhat.com, bbaranow(a)redhat.com,
                    bgeorges(a)redhat.com, bibryam(a)redhat.com,
                    bmaxwell(a)redhat.com, bmontgom(a)redhat.com,
                    brian.stansberry(a)redhat.com, cdewolf(a)redhat.com,
                    chazlett(a)redhat.com, clement.escoffier(a)redhat.com,
                    dandread(a)redhat.com, darran.lofthouse(a)redhat.com,
                    databases-maint(a)redhat.com, dkreling(a)redhat.com,
                    dosoudil(a)redhat.com, drieden(a)redhat.com,
                    eparis(a)redhat.com, etirelli(a)redhat.com,
                    ganandan(a)redhat.com, ggaughan(a)redhat.com,
                    gmalinko(a)redhat.com, gmorling(a)redhat.com,
                    gsmet(a)redhat.com, gvarsami(a)redhat.com,
                    hhorak(a)redhat.com, ibek(a)redhat.com, iweiss(a)redhat.com,
                    janstey(a)redhat.com,
                    java-sig-commits(a)lists.fedoraproject.org,
                    jawilson(a)redhat.com, jbalunas(a)redhat.com,
                    jburrell(a)redhat.com, jcoleman(a)redhat.com,
                    jjanco(a)redhat.com, jochrist(a)redhat.com,
                    jokerman(a)redhat.com, jolee(a)redhat.com,
                    jpallich(a)redhat.com, jperkins(a)redhat.com,
                    jschatte(a)redhat.com, jstastny(a)redhat.com,
                    jwon(a)redhat.com, kconner(a)redhat.com,
                    krathod(a)redhat.com, kverlaen(a)redhat.com,
                    kwills(a)redhat.com, ldimaggi(a)redhat.com,
                    lgao(a)redhat.com, lthon(a)redhat.com, mmuzila(a)redhat.com,
                    mnovotny(a)redhat.com, mschorm(a)redhat.com,
                    msochure(a)redhat.com, msvehla(a)redhat.com,
                    mszynkie(a)redhat.com, nstielau(a)redhat.com,
                    nwallace(a)redhat.com, odubaj(a)redhat.com,
                    pantinor(a)redhat.com, paradhya(a)redhat.com,
                    pgallagh(a)redhat.com, pjindal(a)redhat.com,
                    pmackay(a)redhat.com, psotirop(a)redhat.com,
                    puntogil(a)libero.it, rguimara(a)redhat.com,
                    rrajasek(a)redhat.com, rruss(a)redhat.com,
                    rstancel(a)redhat.com, rsvoboda(a)redhat.com,
                    rsynek(a)redhat.com, rwagner(a)redhat.com,
                    sbiarozk(a)redhat.com, sdaley(a)redhat.com,
                    sdouglas(a)redhat.com, smaestri(a)redhat.com,
                    sponnaga(a)redhat.com, steve.traylen(a)cern.ch,
                    tcunning(a)redhat.com, tkirby(a)redhat.com,
                    tom.jenkinson(a)redhat.com, vhalbert(a)redhat.com,
                    xjakub(a)fi.muni.cz
  Target Milestone: ---
    Classification: Other



Vulnerability in the MySQL Connectors product of Oracle MySQL (component:
Connector/J). Supported versions that are affected are 8.0.14 and prior and
5.1.48 and prior. Difficult to exploit vulnerability allows unauthenticated
attacker with network access via multiple protocols to compromise MySQL
Connectors. Successful attacks require human interaction from a person other
than the attacker and while the vulnerability is in MySQL Connectors, attacks
may significantly impact additional products. Successful attacks of this
vulnerability can result in unauthorized update, insert or delete access to
some of MySQL Connectors accessible data as well as unauthorized read access to
a subset of MySQL Connectors accessible data. 

References:

https://www.oracle.com/security-alerts/cpuapr2020.html
https://lists.debian.org/debian-lts-announce/2020/06/msg00015.html      
https://www.debian.org/security/2020/dsa-4703


-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1851019] CVE-2020-2875mysql-connector-java: allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors which could result in unauthorized update, insert or delete

https://bugzilla.redhat.com/show_bug.cgi?id=1851019

Michael Kaplan <mkaplan(a)redhat.com&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Depends On|                            |1851020





Referenced Bugs:

https://bugzilla.redhat.com/show_bug.cgi?id=1851020
[Bug 1851020] CVE-2020-2875 mysql-connector-java:
CVE-2020-2875mysql-connector-java: allows unauthenticated attacker with network
access via multiple protocols to compromise MySQL Connectors which could result
in unauthorized update, insert or delete [fedora-all]
-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1851019] CVE-2020-2875mysql-connector-java: allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors which could result in unauthorized update, insert or delete

https://bugzilla.redhat.com/show_bug.cgi?id=1851019



--- Comment #1 from Michael Kaplan <mkaplan(a)redhat.com&gt; ---
Created mysql-connector-java tracking bugs for this issue:

Affects: fedora-all [bug 1851020]


-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1851019] CVE-2020-2875 mysql-connector-java: allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors which could result in unauthorized update, insert or delete

https://bugzilla.redhat.com/show_bug.cgi?id=1851019

Michael Kaplan <mkaplan(a)redhat.com&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|CVE-2020-2875mysql-connecto |CVE-2020-2875
                   |r-java: allows              |mysql-connector-java:
                   |unauthenticated attacker    |allows unauthenticated
                   |with network access via     |attacker with network
                   |multiple protocols to       |access via multiple
                   |compromise MySQL Connectors |protocols to compromise
                   |which could result in       |MySQL Connectors which
                   |unauthorized update, insert |could result in
                   |or delete                   |unauthorized update, insert
                   |                            |or delete




-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1851019] CVE-2020-2875 mysql-connector-java: allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors which could result in unauthorized update, insert or delete

https://bugzilla.redhat.com/show_bug.cgi?id=1851019

Michael Kaplan <mkaplan(a)redhat.com&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Blocks|                            |1851025




-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1851019] CVE-2020-2875 mysql-connector-java: allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors which could result in unauthorized update, insert or delete

https://bugzilla.redhat.com/show_bug.cgi?id=1851019



--- Comment #4 from Kunjan Rathod <krathod(a)redhat.com&gt; ---
This vulnerability is out of security support scope for the following products:
 * Red Hat Enterprise Application Platform 6
 * Red Hat JBoss Data Virtualization & Services 6
 * Red Hat JBoss Fuse Service Works(FSW) 6

Please refer to https://access.redhat.com/support/policy/updates/jboss_notes
for more details.


-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1851019] CVE-2020-2875 mysql-connector-java: allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors which could result in unauthorized update, insert or delete

https://bugzilla.redhat.com/show_bug.cgi?id=1851019


--- Doc Text *updated* by Doran Moppert <dmoppert(a)redhat.com&gt; ---
A complicated attack against the mysql Connector/J could potentially allow attackers on
the local network to interfere with a user's connection, inserting unauthorized SQL
commands.



-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1851019] CVE-2020-2875 mysql-connector-java: allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors which could result in unauthorized update, insert or delete

https://bugzilla.redhat.com/show_bug.cgi?id=1851019



--- Comment #8 from Doran Moppert <dmoppert(a)redhat.com&gt; ---
Statement:

Red Hat Enterprise Linux customers are advised to replace the
mysql-connector-java package with the mariadb-java-client, available in Red Hat
Software Collections.  It can be installed this way:

  # yum-config-manager --enable rhel-server-rhscl-7-rpms

  # yum install rh-mariadb103-mariadb-java-client


-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1851019] CVE-2020-2875 mysql-connector-java: allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors which could result in unauthorized update, insert or delete

https://bugzilla.redhat.com/show_bug.cgi?id=1851019
Bug 1851019 depends on bug 1851020, which changed state.

Bug 1851020 Summary: CVE-2020-2875 mysql-connector-java: allows unauthenticated attacker
with network access via multiple protocols to compromise MySQL Connectors which could
result in unauthorized update, insert or delete [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1851020

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ON_QA                       |CLOSED
         Resolution|---                         |ERRATA




-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1851019] CVE-2020-2875 mysql-connector-java: allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors which could result in unauthorized update, insert or delete

https://bugzilla.redhat.com/show_bug.cgi?id=1851019



--- Comment #9 from errata-xmlrpc <errata-xmlrpc(a)redhat.com&gt; ---
This issue has been addressed in the following products:

  RHDM 7.9.0

Via RHSA-2020:4960 https://access.redhat.com/errata/RHSA-2020:4960


-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1851019] CVE-2020-2875 mysql-connector-java: allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors which could result in unauthorized update, insert or delete

https://bugzilla.redhat.com/show_bug.cgi?id=1851019



--- Comment #10 from errata-xmlrpc <errata-xmlrpc(a)redhat.com&gt; ---
This issue has been addressed in the following products:

  RHPAM 7.9.0

Via RHSA-2020:4961 https://access.redhat.com/errata/RHSA-2020:4961


-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1851019] CVE-2020-2875 mysql-connector-java: allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors which could result in unauthorized update, insert or delete

https://bugzilla.redhat.com/show_bug.cgi?id=1851019

errata-xmlrpc <errata-xmlrpc(a)redhat.com&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Link ID|                            |Red Hat Product Errata
                   |                            |RHSA-2020:4961




-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1851019] CVE-2020-2875 mysql-connector-java: allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors which could result in unauthorized update, insert or delete

https://bugzilla.redhat.com/show_bug.cgi?id=1851019

Product Security DevOps Team <prodsec-dev(a)redhat.com&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |CLOSED
         Resolution|---                         |ERRATA
        Last Closed|                            |2020-11-05 20:21:25



--- Comment #11 from Product Security DevOps Team <prodsec-dev(a)redhat.com&gt; ---
This bug is now closed. Further updates for individual products will be
reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-2875


-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1851019] CVE-2020-2875 mysql-connector-java: allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors which could result in unauthorized update, insert or delete

https://bugzilla.redhat.com/show_bug.cgi?id=1851019



--- Comment #12 from errata-xmlrpc <errata-xmlrpc(a)redhat.com&gt; ---
This issue has been addressed in the following products:

  Red Hat Fuse 7.10

Via RHSA-2021:5134 https://access.redhat.com/errata/RHSA-2021:5134


-- 
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=1851019

[Bug 1851019] CVE-2020-2875 mysql-connector-java: allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors which could result in unauthorized update, insert or delete

https://bugzilla.redhat.com/show_bug.cgi?id=1851019

errata-xmlrpc <errata-xmlrpc(a)redhat.com&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Link ID|                            |Red Hat Product Errata
                   |                            |RHSA-2021:5134




-- 
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=1851019