ALSA-2020:5500 (CVE-2019-2938)

Vulnerability from osv_almalinux – Published: 2020-12-15 16:03 – Updated: 2026-11-02 01:59 – Source website
VLAI
Summary
Important: mariadb:10.3 security, bug fix, and enhancement update
Details

MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL.

The following packages have been upgraded to a later upstream version: mariadb (10.3.27), galera (25.3.31). (BZ#1899082, BZ#1899086)

Security Fix(es):

  • mariadb: Insufficient SST method name check leading to code injection in mysql-wsrep (CVE-2020-15180)

  • mysql: InnoDB unspecified vulnerability (CPU Oct 2019) (CVE-2019-2938)

  • mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2019) (CVE-2019-2974)

  • mysql: C API unspecified vulnerability (CPU Apr 2020) (CVE-2020-2752)

  • mysql: InnoDB unspecified vulnerability (CPU Apr 2020) (CVE-2020-2760)

  • mysql: Server: DML unspecified vulnerability (CPU Apr 2020) (CVE-2020-2780)

  • mysql: Server: Stored Procedure unspecified vulnerability (CPU Apr 2020) (CVE-2020-2812)

  • mysql: InnoDB unspecified vulnerability (CPU Apr 2020) (CVE-2020-2814)

  • mariadb-connector-c: Improper validation of content in a OK packet received from server (CVE-2020-13249)

  • mysql: Server: FTS unspecified vulnerability (CPU Oct 2020) (CVE-2020-14765)

  • mysql: InnoDB unspecified vulnerability (CPU Oct 2020) (CVE-2020-14776)

  • mysql: Server: FTS unspecified vulnerability (CPU Oct 2020) (CVE-2020-14789)

  • mysql: Server: Locking unspecified vulnerability (CPU Oct 2020) (CVE-2020-14812)

  • mysql: C API unspecified vulnerability (CPU Jan 2020) (CVE-2020-2574)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

  • FTBFS: -D_GLIBCXX_ASSERTIONS (BZ#1899009)

  • Queries with entity_id IN ('1', '2', …, '70000') run much slower in MariaDB 10.3 than on MariaDB 10.1 (BZ#1899017)

  • Cleanup race with wsrep_rsync_sst_tunnel may prevent full galera cluster bootstrap (BZ#1899021)

  • There are undeclared file conflicts in several mariadb and mysql packages (BZ#1899077)

References
https://access.redhat.com/errata/RHSA-2020:5500 ADVISORY
https://bugzilla.redhat.com/1764680 REPORT
https://bugzilla.redhat.com/1764691 REPORT
https://bugzilla.redhat.com/1798587 REPORT
https://bugzilla.redhat.com/1830056 REPORT
https://bugzilla.redhat.com/1830059 REPORT
https://bugzilla.redhat.com/1830060 REPORT
https://bugzilla.redhat.com/1830082 REPORT
https://bugzilla.redhat.com/1835849 REPORT
https://bugzilla.redhat.com/1839827 REPORT
https://bugzilla.redhat.com/1890738 REPORT
https://bugzilla.redhat.com/1890743 REPORT
https://bugzilla.redhat.com/1890747 REPORT
https://bugzilla.redhat.com/1890756 REPORT
https://bugzilla.redhat.com/1894919 REPORT
https://bugzilla.redhat.com/1899009 REPORT
https://bugzilla.redhat.com/1899017 REPORT
https://bugzilla.redhat.com/1899021 REPORT
https://bugzilla.redhat.com/1899082 REPORT
https://bugzilla.redhat.com/1899086 REPORT
https://bugzilla.redhat.com/1922389 REPORT
https://bugzilla.redhat.com/1951749 REPORT
https://bugzilla.redhat.com/1951764 REPORT
https://errata.almalinux.org/8/ALSA-2020-5500.html ADVISORY
https://vulners.com/cve/CVE-2019-2938 REPORT
https://vulners.com/cve/CVE-2019-2974 REPORT
https://vulners.com/cve/CVE-2020-13249 REPORT
https://vulners.com/cve/CVE-2020-14765 REPORT
https://vulners.com/cve/CVE-2020-14776 REPORT
https://vulners.com/cve/CVE-2020-14789 REPORT
https://vulners.com/cve/CVE-2020-14812 REPORT
https://vulners.com/cve/CVE-2020-15180 REPORT
https://vulners.com/cve/CVE-2020-2574 REPORT
https://vulners.com/cve/CVE-2020-2752 REPORT
https://vulners.com/cve/CVE-2020-2760 REPORT
https://vulners.com/cve/CVE-2020-2780 REPORT
https://vulners.com/cve/CVE-2020-2812 REPORT
https://vulners.com/cve/CVE-2020-2814 REPORT
https://vulners.com/cve/CVE-2021-2022 REPORT
https://vulners.com/cve/CVE-2021-2144 REPORT
https://vulners.com/cve/CVE-2021-2194 REPORT
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "Judy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.5-18.module_el8.6.0+2867+72759d2f"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "Judy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.5-18.module_el8.5.0+2632+14ced695"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "Judy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.5-18.module_el8.6.0+2761+593e5e59"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL. \n\nThe following packages have been upgraded to a later upstream version: mariadb (10.3.27), galera (25.3.31). (BZ#1899082, BZ#1899086)\n\nSecurity Fix(es):\n\n* mariadb: Insufficient SST method name check leading to code injection in mysql-wsrep (CVE-2020-15180)\n\n* mysql: InnoDB unspecified vulnerability (CPU Oct 2019) (CVE-2019-2938)\n\n* mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2019) (CVE-2019-2974)\n\n* mysql: C API unspecified vulnerability (CPU Apr 2020) (CVE-2020-2752)\n\n* mysql: InnoDB unspecified vulnerability (CPU Apr 2020) (CVE-2020-2760)\n\n* mysql: Server: DML unspecified vulnerability (CPU Apr 2020) (CVE-2020-2780)\n\n* mysql: Server: Stored Procedure unspecified vulnerability (CPU Apr 2020) (CVE-2020-2812)\n\n* mysql: InnoDB unspecified vulnerability (CPU Apr 2020) (CVE-2020-2814)\n\n* mariadb-connector-c: Improper validation of content in a OK packet received from server (CVE-2020-13249)\n\n* mysql: Server: FTS unspecified vulnerability (CPU Oct 2020) (CVE-2020-14765)\n\n* mysql: InnoDB unspecified vulnerability (CPU Oct 2020) (CVE-2020-14776)\n\n* mysql: Server: FTS unspecified vulnerability (CPU Oct 2020) (CVE-2020-14789)\n\n* mysql: Server: Locking unspecified vulnerability (CPU Oct 2020) (CVE-2020-14812)\n\n* mysql: C API unspecified vulnerability (CPU Jan 2020) (CVE-2020-2574)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* FTBFS: -D_GLIBCXX_ASSERTIONS (BZ#1899009)\n\n* Queries with entity_id IN (\u00271\u0027, \u00272\u0027, \u2026, \u002770000\u0027) run much slower in MariaDB 10.3 than on MariaDB 10.1 (BZ#1899017)\n\n* Cleanup race with wsrep_rsync_sst_tunnel may prevent full galera cluster bootstrap (BZ#1899021)\n\n* There are undeclared file conflicts in several mariadb and mysql packages (BZ#1899077)",
  "id": "ALSA-2020:5500",
  "modified": "2026-11-02T01:59:18Z",
  "published": "2020-12-15T16:03:43Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://access.redhat.com/errata/RHSA-2020:5500"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1764680"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1764691"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1798587"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1830056"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1830059"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1830060"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1830082"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1835849"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1839827"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1890738"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1890743"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1890747"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1890756"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1894919"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1899009"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1899017"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1899021"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1899082"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1899086"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1922389"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1951749"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1951764"
    },
    {
      "type": "ADVISORY",
      "url": "https://errata.almalinux.org/8/ALSA-2020-5500.html"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2019-2938"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2019-2974"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2020-13249"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2020-14765"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2020-14776"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2020-14789"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2020-14812"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2020-15180"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2020-2574"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2020-2752"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2020-2760"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2020-2780"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2020-2812"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2020-2814"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2021-2022"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2021-2144"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2021-2194"
    }
  ],
  "related": [
    "CVE-2019-2938",
    "CVE-2019-2974",
    "CVE-2020-13249",
    "CVE-2020-14765",
    "CVE-2020-14776",
    "CVE-2020-14789",
    "CVE-2020-14812",
    "CVE-2020-15180",
    "CVE-2020-2574",
    "CVE-2020-2752",
    "CVE-2020-2760",
    "CVE-2020-2780",
    "CVE-2020-2812",
    "CVE-2020-2814",
    "CVE-2021-2022",
    "CVE-2021-2144",
    "CVE-2021-2194"
  ],
  "schema_version": "1.7.0",
  "summary": "Important: mariadb:10.3 security, bug fix, and enhancement update",
  "upstream": [
    "CVE-2019-2938",
    "CVE-2019-2974",
    "CVE-2020-13249",
    "CVE-2020-14765",
    "CVE-2020-14776",
    "CVE-2020-14789",
    "CVE-2020-14812",
    "CVE-2020-15180",
    "CVE-2020-2574",
    "CVE-2020-2752",
    "CVE-2020-2760",
    "CVE-2020-2780",
    "CVE-2020-2812",
    "CVE-2020-2814",
    "CVE-2021-2022",
    "CVE-2021-2144",
    "CVE-2021-2194"
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.