CVE-2020-13249 Other in n/a
The MariaDB Connector/C library fails to properly validate OK packet content, potentially leading to undefined behavior or security issues.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-13249?
CVE-2020-13249 is a high-severity vulnerability in Fedoraproject Fedora, published on 20 May 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
libmariadb/mariadb_lib.c in MariaDB Connector/C before 3.1.8 does not properly validate the content of an OK packet received from a server. NOTE: although mariadb_lib.c was originally based on code shipped for MySQL, this issue does not affect any MySQL components supported by Oracle.
Which versions are affected by CVE-2020-13249?
It affects 3 products.
Linux distribution packages (11)
mariadb-connector-c SUSE:Linux Enterprise High Performance Computing 15-ESPOS | All versions | 3.1.8-3.18.1 |
mariadb-connector-c SUSE:Linux Enterprise High Performance Computing 15-LTSS | All versions | 3.1.8-3.18.1 |
mariadb-connector-c SUSE:Linux Enterprise Module for Basesystem 15 SP1 | All versions | 3.1.8-3.18.1 |
mariadb-connector-c SUSE:Linux Enterprise Module for Server Applications 15 SP1 | All versions | 3.1.8-3.18.1 |
mariadb-connector-c SUSE:Linux Enterprise Server 12 SP4 | All versions | 3.1.8-2.15.1 |
mariadb-connector-c SUSE:Linux Enterprise Server 12 SP5 | All versions | 3.1.8-2.15.1 |
mariadb-connector-c SUSE:Linux Enterprise Server 15-LTSS | All versions | 3.1.8-3.18.1 |
mariadb-connector-c SUSE:Linux Enterprise Server for SAP Applications 12 SP4 | All versions | 3.1.8-2.15.1 |
mariadb-connector-c SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | All versions | 3.1.8-2.15.1 |
mariadb-connector-c SUSE:Linux Enterprise Server for SAP Applications 15 | All versions | 3.1.8-3.18.1 |
mariadb-connector-c openSUSE:Leap 15.1 | All versions | 3.1.8-lp151.3.12.1 |
Products include Fedoraproject Fedora, Mariadb Connector\/C, Opensuse Leap.
How do I fix CVE-2020-13249?
Upgrade to a fixed version.
Is CVE-2020-13249 being exploited?
There is no known exploitation of CVE-2020-13249 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as ALPINE-CVE-2020-13249, GHSA-44c7-hc99-224f, JLSEC-2026-211, SUSE-SU-2020:1423-1, SUSE-SU-2020:1431-1, UBUNTU-CVE-2020-13249 and 2 more.