125 Star 1 Fork 58

src-openEuler/mysql

CVE-2024-20985

Done
CVE和安全问题 owner
Opened this issue  
2024-01-17 08:15

一、漏洞信息
漏洞编号:CVE-2024-20985
漏洞归属组件:mysql
漏洞归属的版本:8.0.17,8.0.23,8.0.24,8.0.26,8.0.27,8.0.28,8.0.29,8.0.30,8.0.35,8.0.37
CVSS V3.0分值:
BaseScore:6.5 Medium
Vector:CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
漏洞简述:
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: UDF). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
漏洞公开时间:2024-01-17 06:15:45
漏洞创建时间:2024-01-17 08:15:34
漏洞详情参考链接:
https://nvd.nist.gov/vuln/detail/CVE-2024-20985

更多参考(点击展开)
参考来源 参考链接 来源链接
secalert_us.oracle.com https://security.netapp.com/advisory/ntap-20240201-0003/
secalert_us.oracle.com https://www.oracle.com/security-alerts/cpujan2024.html
redhat_bugzilla https://www.oracle.com/security-alerts/cpujan2024.html#AppendixMSQL https://bugzilla.redhat.com/show_bug.cgi?id=2258794
redhat_bugzilla https://access.redhat.com/errata/RHSA-2024:0894 https://bugzilla.redhat.com/show_bug.cgi?id=2258794
redhat_bugzilla https://access.redhat.com/errata/RHSA-2024:1141 https://bugzilla.redhat.com/show_bug.cgi?id=2258794
ubuntu https://www.oracle.com/security-alerts/cpujan2024.html https://ubuntu.com/security/CVE-2024-20985
ubuntu https://ubuntu.com/security/notices/USN-6615-1 https://ubuntu.com/security/CVE-2024-20985
ubuntu https://www.cve.org/CVERecord?id=CVE-2024-20985 https://ubuntu.com/security/CVE-2024-20985
ubuntu https://nvd.nist.gov/vuln/detail/CVE-2024-20985 https://ubuntu.com/security/CVE-2024-20985
ubuntu https://launchpad.net/bugs/cve/CVE-2024-20985 https://ubuntu.com/security/CVE-2024-20985
ubuntu https://security-tracker.debian.org/tracker/CVE-2024-20985 https://ubuntu.com/security/CVE-2024-20985
debian https://security-tracker.debian.org/tracker/CVE-2024-20985
oracle https://www.oracle.com/security-alerts/cpujan2024.html
anolis https://anas.openanolis.cn/cves/detail/CVE-2024-20985
cve_search https://www.oracle.com/security-alerts/cpujan2024.html
cve_search https://security.netapp.com/advisory/ntap-20240201-0003/
snyk https://bugzilla.redhat.com/show_bug.cgi?id=2258794 https://security.snyk.io/vuln/SNYK-UNMANAGED-MYSQLMYSQLSERVER-6170051
snyk https://www.oracle.com/security-alerts/cpujan2024.html#AppendixMSQL https://security.snyk.io/vuln/SNYK-UNMANAGED-MYSQLMYSQLSERVER-6170051

漏洞分析指导链接:
https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
漏洞数据来源:
openBrain开源漏洞感知系统
漏洞补丁信息:

详情(点击展开)
影响的包 修复版本 修复补丁 问题引入补丁 来源
https://security.netapp.com/advisory/ntap-20240201-0003/ nvd
https://www.oracle.com/security-alerts/cpujan2024.html nvd

二、漏洞分析结构反馈
影响性分析说明:
该漏洞目前版本均受影响,升级至8.0.37版本修复
openEuler评分:
6.5
Vector:CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
受影响版本排查(受影响/不受影响):
1.openEuler-20.03-LTS-SP4(8.0.28):受影响
2.openEuler-22.03-LTS-SP1(8.0.37):受影响
3.openEuler-22.03-LTS-SP3(8.0.37):受影响
4.openEuler-24.03-LTS(8.0.35):受影响
5.master(8.0.27):不受影响
6.openEuler-24.03-LTS-Next(8.0.37):不受影响
7.openEuler-22.03-LTS-SP4(8.0.37):不受影响

修复是否涉及abi变化(是/否):
1.master(8.0.27):否
2.openEuler-20.03-LTS-SP4(8.0.28):否
3.openEuler-22.03-LTS-SP1(8.0.37):否
4.openEuler-22.03-LTS-SP3(8.0.37):否
5.openEuler-24.03-LTS(8.0.35):否
6.openEuler-24.03-LTS-Next(8.0.37):否
7.openEuler-22.03-LTS-SP4(8.0.37):否

三、漏洞修复
安全公告链接:https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2024-2071

Comments (11)

openeuler-ci-bot createdCVE和安全问题 a year ago
openeuler-ci-bot added
 
CVE/UNFIXED
label
a year ago
Expand operation logs
参考网址 关联pr 状态 补丁链接
https://nvd.nist.gov/vuln/detail/CVE-2024-20985
https://ubuntu.com/security/CVE-2024-20985NoneNonehttps://discourse.ubuntu.com/c/ubuntu-pro
https://www.opencve.io/cve/CVE-2024-20985
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2024-20985
https://security-tracker.debian.org/tracker/CVE-2024-20985

说明:补丁链接仅供初步排查参考,实际可用性请人工再次确认,补丁下载验证可使用CVE补丁工具
若补丁不准确,烦请在此issue下评论 '/report-patch 参考网址 补丁链接1,补丁链接2' 反馈正确信息,便于我们不断优化工具,不胜感激。
如 /report-patch https://security-tracker.debian.org/tracker/CVE-2021-3997 https://github.com/systemd/systemd/commit/5b1cf7a9be37e20133c0208005274ce4a5b5c6a1

openeuler-ci-bot set start time to 2024-01-17 a year ago
openeuler-ci-bot set deadline to 2024-02-16 a year ago
openeuler-ci-bot set priority to Secondary a year ago
openeuler-ci-bot changed description a year ago
openeuler-ci-bot changed start time from 2024-01-17 to 2024-01-18 a year ago
openeuler-ci-bot changed deadline from 2024-02-16 to 2024-02-17 a year ago
openeuler-ci-bot changed description a year ago
openeuler-ci-bot changed description a year ago
openeuler-ci-bot changed description a year ago
openeuler-ci-bot changed description a year ago
wk333-wk333 wk333 member a year ago
wk333 changed issue state from 待办的 to 已挂起 a year ago
wk333 related pull requestsrc-openEuler/mysql Pull Request !124 a year ago
wk333 related pull requestsrc-openEuler/mysql Pull Request !125 a year ago
wk333 related pull requestsrc-openEuler/mysql Pull Request !127 a year ago
wk333 related pull requestsrc-openEuler/mysql Pull Request !128 a year ago
wk333 related pull requestsrc-openEuler/mysql Pull Request !129 a year ago
wk333 related pull requestsrc-openEuler/mysql Pull Request !130 a year ago
wk333 related pull requestsrc-openEuler/mysql Pull Request !131 a year ago
wk333 related pull requestsrc-openEuler/mysql Pull Request !132 a year ago
wk333 through merging Pull Request !128: Update to 8.0.37 for fix CVEs changed issue state from 已挂起 to 已完成 a year ago
openeuler-ci-bot changed issue state from 已完成 to 待办的 a year ago
openeuler-ci-bot changed description a year ago
openeuler-ci-bot removed
 
CVE/UNFIXED
label
a year ago
openeuler-ci-bot added
 
CVE/UNFIXED
label
a year ago
wk333-wk333 wk333 member a year ago

影响性分析说明:
该漏洞目前版本均受影响,升级至8.0.37版本修复

openEuler评分:
BaseScore: 6.5 Medium
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

受影响版本排查(受影响/不受影响):
1.master:受影响
2.openEuler-20.03-LTS-SP1:受影响
3.openEuler-20.03-LTS-SP4:受影响
4.openEuler-22.03-LTS:受影响
5.openEuler-22.03-LTS-Next:受影响
6.openEuler-22.03-LTS-SP1:受影响
7.openEuler-22.03-LTS-SP2:受影响
8.openEuler-22.03-LTS-SP3:受影响
9.openEuler-24.03-LTS:受影响
10.openEuler-24.03-LTS-Next:受影响

修复是否涉及abi变化(是/否):
1.master:否
2.openEuler-20.03-LTS-SP1:否
3.openEuler-20.03-LTS-SP4:否
4.openEuler-22.03-LTS:否
5.openEuler-22.03-LTS-Next:否
6.openEuler-22.03-LTS-SP1:否
7.openEuler-22.03-LTS-SP2:否
8.openEuler-22.03-LTS-SP3:否
9.openEuler-24.03-LTS:否
10.openEuler-24.03-LTS-Next:否

openeuler-ci-bot changed description a year ago

@ 经过 cve-manager 解析, 已分析的内容如下表所示:

状态 需分析 内容
已分析 1.影响性分析说明 该漏洞目前版本均受影响,升级至8.0.37版本修复
已分析 2.openEulerScore 6.5
已分析 3.openEulerVector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
已分析 4.受影响版本排查 master:受影响,openEuler-20.03-LTS-SP1:受影响,openEuler-20.03-LTS-SP4:受影响,openEuler-22.03-LTS:受影响,openEuler-22.03-LTS-Next:受影响,openEuler-22.03-LTS-SP1:受影响,openEuler-22.03-LTS-SP2:受影响,openEuler-22.03-LTS-SP3:受影响,openEuler-24.03-LTS:受影响,openEuler-24.03-LTS-Next:受影响
已分析 5.修复是否涉及abi变化 master:否,openEuler-20.03-LTS-SP1:否,openEuler-20.03-LTS-SP4:否,openEuler-22.03-LTS:否,openEuler-22.03-LTS-Next:否,openEuler-22.03-LTS-SP1:否,openEuler-22.03-LTS-SP2:否,openEuler-22.03-LTS-SP3:否,openEuler-24.03-LTS:否,openEuler-24.03-LTS-Next:否

请确认分析内容的准确性, 确认无误后, 您可以进行后续步骤, 否则您可以继续分析.

wk333 no related repositorysrc-openEuler/mysql Pull Request !132 a year ago
openeuler-ci-bot changed start time from 2024-01-18 to 2024-04-12 a year ago
openeuler-ci-bot changed deadline from 2024-02-17 to 2024-05-12 a year ago
openeuler-ci-bot changed description a year ago
wk333 related pull requestsrc-openEuler/mysql Pull Request !136 12 months ago
openeuler-ci-bot changed description 12 months ago
wk333 related pull requestsrc-openEuler/mysql Pull Request !150 10 months ago
wk333-wk333 wk333 member 10 months ago

受影响版本排查(受影响/不受影响):
1.master:不受影响
2.openEuler-20.03-LTS-SP4:受影响
3.openEuler-22.03-LTS-SP1:受影响
4.openEuler-22.03-LTS-SP3:受影响
5.openEuler-24.03-LTS:受影响
6.openEuler-24.03-LTS-Next:受影响
7.openEuler-22.03-LTS-SP4:不受影响

修复是否涉及abi变化(是/否):
1.master:否
2.openEuler-20.03-LTS-SP4:否
3.openEuler-22.03-LTS-SP1:否
4.openEuler-22.03-LTS-SP3:否
5.openEuler-24.03-LTS:否
6.openEuler-24.03-LTS-Next:否
7.openEuler-22.03-LTS-SP4:否

openeuler-ci-bot changed description 10 months ago

@ 经过 cve-manager 解析, 已分析的内容如下表所示:

状态 需分析 内容
已分析 1.影响性分析说明 该漏洞目前版本均受影响,升级至8.0.37版本修复
已分析 2.openEulerScore 6.5
已分析 3.openEulerVector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
已分析 4.受影响版本排查 openEuler-20.03-LTS-SP4:受影响,openEuler-22.03-LTS-SP1:受影响,openEuler-22.03-LTS-SP3:受影响,openEuler-24.03-LTS:受影响,openEuler-24.03-LTS-Next:受影响,master:不受影响,openEuler-22.03-LTS-SP4:不受影响
已分析 5.修复是否涉及abi变化 master:否,openEuler-20.03-LTS-SP4:否,openEuler-22.03-LTS-SP1:否,openEuler-22.03-LTS-SP3:否,openEuler-24.03-LTS:否,openEuler-24.03-LTS-Next:否,openEuler-22.03-LTS-SP4:否

请确认分析内容的准确性, 确认无误后, 您可以进行后续步骤, 否则您可以继续分析.

starlet_dx changed issue state from 待办的 to 已完成 10 months ago
openeuler-ci-bot changed issue state from 已完成 to 待办的 10 months ago
openeuler-ci-bot removed
 
CVE/UNFIXED
label
10 months ago
openeuler-ci-bot added
 
CVE/UNFIXED
label
10 months ago
wk333-wk333 wk333 member 10 months ago

受影响版本排查(受影响/不受影响):
1.master:不受影响
2.openEuler-20.03-LTS-SP4:受影响
3.openEuler-22.03-LTS-SP1:受影响
4.openEuler-22.03-LTS-SP3:受影响
5.openEuler-24.03-LTS:受影响
6.openEuler-24.03-LTS-Next:不受影响
7.openEuler-22.03-LTS-SP4:不受影响

修复是否涉及abi变化(是/否):
1.master:否
2.openEuler-20.03-LTS-SP4:否
3.openEuler-22.03-LTS-SP1:否
4.openEuler-22.03-LTS-SP3:否
5.openEuler-24.03-LTS:否
6.openEuler-24.03-LTS-Next:否
7.openEuler-22.03-LTS-SP4:否

openeuler-ci-bot changed description 10 months ago

@ 经过 cve-manager 解析, 已分析的内容如下表所示:

状态 需分析 内容
已分析 1.影响性分析说明 该漏洞目前版本均受影响,升级至8.0.37版本修复
已分析 2.openEulerScore 6.5
已分析 3.openEulerVector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
已分析 4.受影响版本排查 openEuler-20.03-LTS-SP4:受影响,openEuler-22.03-LTS-SP1:受影响,openEuler-22.03-LTS-SP3:受影响,openEuler-24.03-LTS:受影响,master:不受影响,openEuler-24.03-LTS-Next:不受影响,openEuler-22.03-LTS-SP4:不受影响
已分析 5.修复是否涉及abi变化 master:否,openEuler-20.03-LTS-SP4:否,openEuler-22.03-LTS-SP1:否,openEuler-22.03-LTS-SP3:否,openEuler-24.03-LTS:否,openEuler-24.03-LTS-Next:否,openEuler-22.03-LTS-SP4:否

请确认分析内容的准确性, 确认无误后, 您可以进行后续步骤, 否则您可以继续分析.

starlet_dx changed issue state from 待办的 to 已完成 10 months ago
openeuler-ci-bot removed
 
CVE/UNFIXED
label
10 months ago
openeuler-ci-bot added
 
CVE/UNFIXED
label
10 months ago
openeuler-ci-bot removed
 
CVE/UNFIXED
label
10 months ago
openeuler-ci-bot added
 
CVE/FIXED
label
10 months ago
openeuler-ci-bot changed description 9 months ago

Sign in to comment

Status
Assignees
Projects
Duration (hours)
Planed to start   -   Planed to end
-
Top level
Priority
Milestones
Branches
参与者(2)
5329419 openeuler ci bot 1632792936 wk333-wk333
1
https://gitee.com/src-openeuler/mysql.git
git@gitee.com:src-openeuler/mysql.git
src-openeuler
mysql
mysql

Search