[ALAS-2020-1439] Amazon Linux AMI 2014.03 - ALAS-2020-1439: medium priority package update for mysql57

Severity Medium
Affected Packages 20
CVEs 7

Package updates are available for Amazon Linux AMI that fix the following vulnerabilities:
CVE-2020-14576:
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: UDF). Supported versions that are affected are 5.7.30 and prior and 8.0.20 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
1865955: CVE-2020-14576 mysql: Server: UDF unspecified vulnerability (CPU Jul 2020)

CVE-2020-14559:
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema). Supported versions that are affected are 5.6.48 and prior, 5.7.30 and prior and 8.0.20 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Server accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
1865951: CVE-2020-14559 mysql: Server: Information Schema unspecified vulnerability (CPU Jul 2020)

CVE-2020-14553:
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Pluggable Auth). Supported versions that are affected are 5.7.30 and prior and 8.0.20 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.1 Base Score 4.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N).
1865950: CVE-2020-14553 mysql: Server: Pluggable Auth unspecified vulnerability (CPU Jul 2020)

CVE-2020-14550:
Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are affected are 5.6.48 and prior, 5.7.30 and prior and 8.0.20 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Client. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Client. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H).
1865949: CVE-2020-14550 mysql: C API unspecified vulnerability (CPU Jul 2020)

CVE-2020-14547:
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 5.7.30 and prior and 8.0.20 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
1865948: CVE-2020-14547 mysql: Server: Optimizer unspecified vulnerability (CPU Jul 2020)

CVE-2020-14540:
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 5.7.30 and prior and 8.0.20 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
1865947: CVE-2020-14540 mysql: Server: DML unspecified vulnerability (CPU Jul 2020)

CVE-2020-14539:
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 5.6.48 and prior, 5.7.30 and prior and 8.0.20 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
1865945: CVE-2020-14539 mysql: Server: Optimizer unspecified vulnerability (CPU Jul 2020)

Package Affected Version
pkg:rpm/amazonlinux/mysql57?arch=x86_64&distro=amazonlinux-1 < 5.7.31-1.16.amzn1
pkg:rpm/amazonlinux/mysql57?arch=i686&distro=amazonlinux-1 < 5.7.31-1.16.amzn1
pkg:rpm/amazonlinux/mysql57-test?arch=x86_64&distro=amazonlinux-1 < 5.7.31-1.16.amzn1
pkg:rpm/amazonlinux/mysql57-test?arch=i686&distro=amazonlinux-1 < 5.7.31-1.16.amzn1
pkg:rpm/amazonlinux/mysql57-server?arch=x86_64&distro=amazonlinux-1 < 5.7.31-1.16.amzn1
pkg:rpm/amazonlinux/mysql57-server?arch=i686&distro=amazonlinux-1 < 5.7.31-1.16.amzn1
pkg:rpm/amazonlinux/mysql57-libs?arch=x86_64&distro=amazonlinux-1 < 5.7.31-1.16.amzn1
pkg:rpm/amazonlinux/mysql57-libs?arch=i686&distro=amazonlinux-1 < 5.7.31-1.16.amzn1
pkg:rpm/amazonlinux/mysql57-errmsg?arch=x86_64&distro=amazonlinux-1 < 5.7.31-1.16.amzn1
pkg:rpm/amazonlinux/mysql57-errmsg?arch=i686&distro=amazonlinux-1 < 5.7.31-1.16.amzn1
pkg:rpm/amazonlinux/mysql57-embedded?arch=x86_64&distro=amazonlinux-1 < 5.7.31-1.16.amzn1
pkg:rpm/amazonlinux/mysql57-embedded?arch=i686&distro=amazonlinux-1 < 5.7.31-1.16.amzn1
pkg:rpm/amazonlinux/mysql57-embedded-devel?arch=x86_64&distro=amazonlinux-1 < 5.7.31-1.16.amzn1
pkg:rpm/amazonlinux/mysql57-embedded-devel?arch=i686&distro=amazonlinux-1 < 5.7.31-1.16.amzn1
pkg:rpm/amazonlinux/mysql57-devel?arch=x86_64&distro=amazonlinux-1 < 5.7.31-1.16.amzn1
pkg:rpm/amazonlinux/mysql57-devel?arch=i686&distro=amazonlinux-1 < 5.7.31-1.16.amzn1
pkg:rpm/amazonlinux/mysql57-debuginfo?arch=x86_64&distro=amazonlinux-1 < 5.7.31-1.16.amzn1
pkg:rpm/amazonlinux/mysql57-debuginfo?arch=i686&distro=amazonlinux-1 < 5.7.31-1.16.amzn1
pkg:rpm/amazonlinux/mysql57-common?arch=x86_64&distro=amazonlinux-1 < 5.7.31-1.16.amzn1
pkg:rpm/amazonlinux/mysql57-common?arch=i686&distro=amazonlinux-1 < 5.7.31-1.16.amzn1
Type Package URL Namespace Name / Product Version Distribution / Platform Arch Patch / Fix
Affected pkg:rpm/amazonlinux/mysql57?arch=x86_64&distro=amazonlinux-1 amazonlinux mysql57 < 5.7.31-1.16.amzn1 amazonlinux-1 x86_64
Affected pkg:rpm/amazonlinux/mysql57?arch=i686&distro=amazonlinux-1 amazonlinux mysql57 < 5.7.31-1.16.amzn1 amazonlinux-1 i686
Affected pkg:rpm/amazonlinux/mysql57-test?arch=x86_64&distro=amazonlinux-1 amazonlinux mysql57-test < 5.7.31-1.16.amzn1 amazonlinux-1 x86_64
Affected pkg:rpm/amazonlinux/mysql57-test?arch=i686&distro=amazonlinux-1 amazonlinux mysql57-test < 5.7.31-1.16.amzn1 amazonlinux-1 i686
Affected pkg:rpm/amazonlinux/mysql57-server?arch=x86_64&distro=amazonlinux-1 amazonlinux mysql57-server < 5.7.31-1.16.amzn1 amazonlinux-1 x86_64
Affected pkg:rpm/amazonlinux/mysql57-server?arch=i686&distro=amazonlinux-1 amazonlinux mysql57-server < 5.7.31-1.16.amzn1 amazonlinux-1 i686
Affected pkg:rpm/amazonlinux/mysql57-libs?arch=x86_64&distro=amazonlinux-1 amazonlinux mysql57-libs < 5.7.31-1.16.amzn1 amazonlinux-1 x86_64
Affected pkg:rpm/amazonlinux/mysql57-libs?arch=i686&distro=amazonlinux-1 amazonlinux mysql57-libs < 5.7.31-1.16.amzn1 amazonlinux-1 i686
Affected pkg:rpm/amazonlinux/mysql57-errmsg?arch=x86_64&distro=amazonlinux-1 amazonlinux mysql57-errmsg < 5.7.31-1.16.amzn1 amazonlinux-1 x86_64
Affected pkg:rpm/amazonlinux/mysql57-errmsg?arch=i686&distro=amazonlinux-1 amazonlinux mysql57-errmsg < 5.7.31-1.16.amzn1 amazonlinux-1 i686
Affected pkg:rpm/amazonlinux/mysql57-embedded?arch=x86_64&distro=amazonlinux-1 amazonlinux mysql57-embedded < 5.7.31-1.16.amzn1 amazonlinux-1 x86_64
Affected pkg:rpm/amazonlinux/mysql57-embedded?arch=i686&distro=amazonlinux-1 amazonlinux mysql57-embedded < 5.7.31-1.16.amzn1 amazonlinux-1 i686
Affected pkg:rpm/amazonlinux/mysql57-embedded-devel?arch=x86_64&distro=amazonlinux-1 amazonlinux mysql57-embedded-devel < 5.7.31-1.16.amzn1 amazonlinux-1 x86_64
Affected pkg:rpm/amazonlinux/mysql57-embedded-devel?arch=i686&distro=amazonlinux-1 amazonlinux mysql57-embedded-devel < 5.7.31-1.16.amzn1 amazonlinux-1 i686
Affected pkg:rpm/amazonlinux/mysql57-devel?arch=x86_64&distro=amazonlinux-1 amazonlinux mysql57-devel < 5.7.31-1.16.amzn1 amazonlinux-1 x86_64
Affected pkg:rpm/amazonlinux/mysql57-devel?arch=i686&distro=amazonlinux-1 amazonlinux mysql57-devel < 5.7.31-1.16.amzn1 amazonlinux-1 i686
Affected pkg:rpm/amazonlinux/mysql57-debuginfo?arch=x86_64&distro=amazonlinux-1 amazonlinux mysql57-debuginfo < 5.7.31-1.16.amzn1 amazonlinux-1 x86_64
Affected pkg:rpm/amazonlinux/mysql57-debuginfo?arch=i686&distro=amazonlinux-1 amazonlinux mysql57-debuginfo < 5.7.31-1.16.amzn1 amazonlinux-1 i686
Affected pkg:rpm/amazonlinux/mysql57-common?arch=x86_64&distro=amazonlinux-1 amazonlinux mysql57-common < 5.7.31-1.16.amzn1 amazonlinux-1 x86_64
Affected pkg:rpm/amazonlinux/mysql57-common?arch=i686&distro=amazonlinux-1 amazonlinux mysql57-common < 5.7.31-1.16.amzn1 amazonlinux-1 i686
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories Exploits PoC Pubblication Date Modification Date
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories PoC Pubblication Date Modification Date
Loading...