https://bugzilla.redhat.com/show_bug.cgi?id=1444406
Bug ID: 1444406 Summary: CVE-2017-3586 mysql-connector-java: Connector/J unspecified vulnerability (CPU Apr 2017) Product: Security Response Component: vulnerability Keywords: Security Severity: high Priority: high Assignee: security-response-team@redhat.com Reporter: amaris@redhat.com CC: abhgupta@redhat.com, aileenc@redhat.com, avibelli@redhat.com, chazlett@redhat.com, coneill@redhat.com, databases-maint@redhat.com, gsterlin@redhat.com, gvarsami@redhat.com, hhorak@redhat.com, java-sig-commits@lists.fedoraproject.org, jbalunas@redhat.com, jcoleman@redhat.com, jshepherd@redhat.com, kconner@redhat.com, kseifried@redhat.com, ldimaggi@redhat.com, mmuzila@redhat.com, mschorm@redhat.com, nwallace@redhat.com, puntogil@libero.it, rrajasek@redhat.com, rwagner@redhat.com, tcunning@redhat.com, tiwillia@redhat.com, tjay@redhat.com, tkirby@redhat.com, xjakub@fi.muni.cz
Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/J). Supported versions that are affected are 5.1.41 and earlier. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. While the vulnerability is in MySQL Connectors, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Connectors accessible data as well as unauthorized read access to a subset of MySQL Connectors accessible data.
External References:
http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html#...
https://bugzilla.redhat.com/show_bug.cgi?id=1444406
Adam Mariš amaris@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Priority|high |medium Whiteboard|impact=important,public=201 |impact=moderate,public=2017 |70419,reported=20170419,sou |0419,reported=20170419,sour |rce=internet,cvss3=8.1/CVSS |ce=internet,cvss3=6.4/CVSS: |:3.0/AV:N/AC:L/PR:L/UI:N/S: |3.0/AV:N/AC:L/PR:L/UI:N/S:C |U/C:H/I:H/A:N,rhel-6/mysql- |/C:L/I:L/A:N,rhel-6/mysql-c |connector-java=affected,rhe |onnector-java=affected,rhel |l-7/mysql-connector-java=af |-7/mysql-connector-java=aff |fected,rhmap-4/mysql-connec |ected,rhmap-4/mysql-connect |tor-java=affected,rhsso-7/m |or-java=affected,rhsso-7/my |ysql-connector-java=affecte |sql-connector-java=affected |d,openshift-enterprise-2/my |,openshift-enterprise-2/mys |sql-connector-java=affected |ql-connector-java=affected, |,jpp-6/mysql-connector-java |jpp-6/mysql-connector-java= |=affected,fsw-6/mysql-conne |affected,fsw-6/mysql-connec |ctor-java=affected,fedora-a |tor-java=affected,fedora-al |ll/mysql-connector-java=aff |l/mysql-connector-java=affe |ected |cted Severity|high |medium
https://bugzilla.redhat.com/show_bug.cgi?id=1444406
Adam Mariš amaris@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1444415 Depends On| |1444418
--- Comment #1 from Adam Mariš amaris@redhat.com --- Created mysql-connector-java tracking bugs for this issue:
Affects: fedora-all [bug 1444418]
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1444418 [Bug 1444418] CVE-2017-3586 CVE-2017-3589 mysql-connector-java: various flaws [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1444406
Apurbita Mukherjee apmukher@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |apmukher@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1444406
Yasuhiro Ozone yozone@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |yozone@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1444406
Stefan Cornelius scorneli@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=moderate,public=2017 |impact=moderate,public=2017 |0419,reported=20170419,sour |0419,reported=20170419,sour |ce=internet,cvss3=6.4/CVSS: |ce=internet,cvss3=6.4/CVSS: |3.0/AV:N/AC:L/PR:L/UI:N/S:C |3.0/AV:N/AC:L/PR:L/UI:N/S:C |/C:L/I:L/A:N,rhel-6/mysql-c |/C:L/I:L/A:N,rhel-6/mysql-c |onnector-java=affected,rhel |onnector-java=wontfix,rhel- |-7/mysql-connector-java=aff |7/mysql-connector-java=affe |ected,rhmap-4/mysql-connect |cted,rhmap-4/mysql-connecto |or-java=affected,rhsso-7/my |r-java=affected,rhsso-7/mys |sql-connector-java=affected |ql-connector-java=affected, |,openshift-enterprise-2/mys |openshift-enterprise-2/mysq |ql-connector-java=affected, |l-connector-java=affected,j |jpp-6/mysql-connector-java= |pp-6/mysql-connector-java=a |affected,fsw-6/mysql-connec |ffected,fsw-6/mysql-connect |tor-java=affected,fedora-al |or-java=affected,fedora-all |l/mysql-connector-java=affe |/mysql-connector-java=affec |cted |ted
https://bugzilla.redhat.com/show_bug.cgi?id=1444406
Stefan Cornelius scorneli@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1464467, 1464466
https://bugzilla.redhat.com/show_bug.cgi?id=1444406
--- Comment #6 from Stefan Cornelius scorneli@redhat.com --- Statement:
This issue affects the versions of mysql-connector-java as shipped with Red Hat Enterprise Linux 6 and 7.
https://bugzilla.redhat.com/show_bug.cgi?id=1444406
Stefan Cornelius scorneli@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=moderate,public=2017 |impact=moderate,public=2017 |0419,reported=20170419,sour |0419,reported=20170419,sour |ce=internet,cvss3=6.4/CVSS: |ce=internet,cvss3=6.4/CVSS: |3.0/AV:N/AC:L/PR:L/UI:N/S:C |3.0/AV:N/AC:L/PR:L/UI:N/S:C |/C:L/I:L/A:N,rhel-6/mysql-c |/C:L/I:L/A:N,rhel-6/mysql-c |onnector-java=wontfix,rhel- |onnector-java=wontfix,rhel- |7/mysql-connector-java=affe |7/mysql-connector-java=wont |cted,rhmap-4/mysql-connecto |fix,rhmap-4/mysql-connector |r-java=affected,rhsso-7/mys |-java=affected,rhsso-7/mysq |ql-connector-java=affected, |l-connector-java=affected,o |openshift-enterprise-2/mysq |penshift-enterprise-2/mysql |l-connector-java=affected,j |-connector-java=affected,jp |pp-6/mysql-connector-java=a |p-6/mysql-connector-java=af |ffected,fsw-6/mysql-connect |fected,fsw-6/mysql-connecto |or-java=affected,fedora-all |r-java=affected,fedora-all/ |/mysql-connector-java=affec |mysql-connector-java=affect |ted |ed
https://bugzilla.redhat.com/show_bug.cgi?id=1444406
Chess Hazlett chazlett@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=moderate,public=2017 |impact=moderate,public=2017 |0419,reported=20170419,sour |0419,reported=20170419,sour |ce=internet,cvss3=6.4/CVSS: |ce=internet,cvss3=6.4/CVSS: |3.0/AV:N/AC:L/PR:L/UI:N/S:C |3.0/AV:N/AC:L/PR:L/UI:N/S:C |/C:L/I:L/A:N,rhel-6/mysql-c |/C:L/I:L/A:N,rhel-6/mysql-c |onnector-java=wontfix,rhel- |onnector-java=wontfix,rhel- |7/mysql-connector-java=wont |7/mysql-connector-java=wont |fix,rhmap-4/mysql-connector |fix,rhmap-4/mysql-connector |-java=affected,rhsso-7/mysq |-java=affected,rhsso-7/mysq |l-connector-java=affected,o |l-connector-java=affected,o |penshift-enterprise-2/mysql |penshift-enterprise-2/mysql |-connector-java=affected,jp |-connector-java=affected,jp |p-6/mysql-connector-java=af |p-6/mysql-connector-java=wo |fected,fsw-6/mysql-connecto |ntfix,fsw-6/mysql-connector |r-java=affected,fedora-all/ |-java=affected,fedora-all/m |mysql-connector-java=affect |ysql-connector-java=affecte |ed |d
https://bugzilla.redhat.com/show_bug.cgi?id=1444406
Pavel Polischouk pavelp@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |pavelp@redhat.com Whiteboard|impact=moderate,public=2017 |impact=moderate,public=2017 |0419,reported=20170419,sour |0419,reported=20170419,sour |ce=internet,cvss3=6.4/CVSS: |ce=internet,cvss3=6.4/CVSS: |3.0/AV:N/AC:L/PR:L/UI:N/S:C |3.0/AV:N/AC:L/PR:L/UI:N/S:C |/C:L/I:L/A:N,rhel-6/mysql-c |/C:L/I:L/A:N,rhel-6/mysql-c |onnector-java=wontfix,rhel- |onnector-java=wontfix,rhel- |7/mysql-connector-java=wont |7/mysql-connector-java=wont |fix,rhmap-4/mysql-connector |fix,rhmap-4/mysql-connector |-java=affected,rhsso-7/mysq |-java=affected,rhsso-7/mysq |l-connector-java=affected,o |l-connector-java=affected,o |penshift-enterprise-2/mysql |penshift-enterprise-2/mysql |-connector-java=affected,jp |-connector-java=affected,jp |p-6/mysql-connector-java=wo |p-6/mysql-connector-java=wo |ntfix,fsw-6/mysql-connector |ntfix,fsw-6/mysql-connector |-java=affected,fedora-all/m |-java=wontfix,fedora-all/my |ysql-connector-java=affecte |sql-connector-java=affected |d |
https://bugzilla.redhat.com/show_bug.cgi?id=1444406
Chess Hazlett chazlett@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |drieden@redhat.com, | |pdrozd@redhat.com, | |sthorger@redhat.com Whiteboard|impact=moderate,public=2017 |impact=moderate,public=2017 |0419,reported=20170419,sour |0419,reported=20170419,sour |ce=internet,cvss3=6.4/CVSS: |ce=internet,cvss3=6.4/CVSS: |3.0/AV:N/AC:L/PR:L/UI:N/S:C |3.0/AV:N/AC:L/PR:L/UI:N/S:C |/C:L/I:L/A:N,rhel-6/mysql-c |/C:L/I:L/A:N,rhel-6/mysql-c |onnector-java=wontfix,rhel- |onnector-java=wontfix,rhel- |7/mysql-connector-java=wont |7/mysql-connector-java=wont |fix,rhmap-4/mysql-connector |fix,rhmap-4/mysql-connector |-java=affected,rhsso-7/mysq |-java=affected,rhsso-7/mysq |l-connector-java=affected,o |l-connector-java=notaffecte |penshift-enterprise-2/mysql |d,openshift-enterprise-2/my |-connector-java=affected,jp |sql-connector-java=affected |p-6/mysql-connector-java=wo |,jpp-6/mysql-connector-java |ntfix,fsw-6/mysql-connector |=wontfix,fsw-6/mysql-connec |-java=wontfix,fedora-all/my |tor-java=wontfix,fedora-all |sql-connector-java=affected |/mysql-connector-java=affec | |ted
java-sig-commits@lists.fedoraproject.org