CVE-2020-15180

Description

A flaw was found in the mysql-wsrep component of mariadb. Lack of input sanitization in `wsrep_sst_method` allows for command injection that can be exploited by a remote attacker to execute arbitrary commands on galera cluster nodes. This threatens the system's confidentiality, integrity, and availability. This flaw affects mariadb versions before 10.1.47, before 10.2.34, before 10.3.25, before 10.4.15 and before 10.5.6.

How to fix CVE-2020-15180

To remediate CVE-2020-15180, upgrade the affected package to a fixed version below.

—upgrade to 10.3.25-r0 or later
—upgrade to 10.1.47 or later
—upgrade to 10.1.47 or later
—upgrade to 10.1.47 or later
—upgrade to 10.1.47-0+deb9u1 or later
—upgrade to 1:10.3.25-0+deb10u1 or later
—upgrade to 1:10.5.6-1 or later

Is CVE-2020-15180 being exploited?

Low — EPSS is 4.6%, meaning exploitation activity has not been observed at scale.

Affected packages (7)

from 0, < 10.3.25-r0
>= 10.1.0, < 10.1.47, >= 10.2.0, < 10.2.34, >= 10.3.0, < 10.3.25, >= 10.4.0, < 10.4.15, >= 10.5.0, < 10.5.6
>= 10.1.0, < 10.1.47, >= 10.2.0, < 10.2.34, >= 10.3.0, < 10.3.25, >= 10.4.0, < 10.4.15, >= 10.5.0, < 10.5.6
>= 10.1.0, < 10.1.47, >= 10.2.0, < 10.2.34, >= 10.3.0, < 10.3.25, >= 10.4.0, < 10.4.15, >= 10.5.0, < 10.5.6
from 0, < 10.1.47-0+deb9u1
from 0, < 1:10.3.25-0+deb10u1
from 0, < 1:10.5.6-1

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	CRITICAL9.0	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H