Linux · Oracle Linux · Security advisory · December 18, 2020

ELSA-2020-5500: Security update for 17 packages

ELSA-2020-5500, released December 18, 2020, fixes 14 CVEs across 17 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
14
None rated Critical
Exploited
0
None reported
Highest CVSS
9.0
Base score, 0 to 10
Highest EPSS
0.0532
92nd percentile

Priority of the 14 CVEs

Patch now 0 Urgent 0 High 2 Routine 12

Fixed package versions

ProductReleaseFixed in
Judyol 80:1.0.5-18.module+el8.1.0+5402+691bd77e
Judy-develol 80:1.0.5-18.module+el8.1.0+5402+691bd77e
asio-develol 80:1.10.8-7.module+el8.1.0+5402+691bd77e
galeraol 80:25.3.31-1.module+el8.3.0+7885+7a81225f
mariadbol 83:10.3.27-3.module+el8.3.0+7885+7a81225f
mariadb-backupol 83:10.3.27-3.module+el8.3.0+7885+7a81225f
mariadb-commonol 83:10.3.27-3.module+el8.3.0+7885+7a81225f
mariadb-develol 83:10.3.27-3.module+el8.3.0+7885+7a81225f
mariadb-embeddedol 83:10.3.27-3.module+el8.3.0+7885+7a81225f
mariadb-embedded-develol 83:10.3.27-3.module+el8.3.0+7885+7a81225f
mariadb-errmsgol 83:10.3.27-3.module+el8.3.0+7885+7a81225f
mariadb-gssapi-serverol 83:10.3.27-3.module+el8.3.0+7885+7a81225f
mariadb-oqgraph-engineol 83:10.3.27-3.module+el8.3.0+7885+7a81225f
mariadb-serverol 83:10.3.27-3.module+el8.3.0+7885+7a81225f
mariadb-server-galeraol 83:10.3.27-3.module+el8.3.0+7885+7a81225f
mariadb-server-utilsol 83:10.3.27-3.module+el8.3.0+7885+7a81225f
mariadb-testol 83:10.3.27-3.module+el8.3.0+7885+7a81225f

CVEs this fix closes

PriorityCVETitleCVSSEPSSExploitation
High CVE-2020-15180 galera: MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL9.0 0.0532 None reported
High CVE-2020-13249 galera: MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL8.8 0.0230 None reported
Routine CVE-2019-2974 libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: Optimizer)6.5 0.0376 None reported
Routine CVE-2020-2574 libmysqlclient21: Vulnerability in the MySQL Client product of Oracle MySQL (component: CAPI)5.9 0.0351 None reported
Routine CVE-2020-2760 libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:InnoDB)5.5 0.0319 None reported
Routine CVE-2020-2812 libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: Stored Procedure)4.9 0.0318 None reported
Routine CVE-2020-14765 libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: FTS)6.5 0.0305 None reported
Routine CVE-2019-2938 libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:InnoDB)4.4 0.0299 None reported
Routine CVE-2020-2814 libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:InnoDB)4.9 0.0297 None reported
Routine CVE-2020-14812 libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: Locking)4.9 0.0273 None reported
Routine CVE-2020-14776 libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:InnoDB)4.9 0.0248 None reported
Routine CVE-2020-14789 libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: FTS)4.9 0.0248 None reported
Routine CVE-2020-2780 libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: DML)6.5 0.0245 None reported
Routine CVE-2020-2752 mecab: MySQL is a multi-user, multi-threaded SQL database server5.3 0.0234 None reported
Showing 1 to 14 of 14 1

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.