ALSA-2020:5500 (CVE-2019-2938)

Vulnerability from osv_almalinux – Published: 2020-12-15 16:03 – Updated: 2026-11-02 01:59 – Source website
VLAI
Summary
Important: mariadb:10.3 security, bug fix, and enhancement update
Details

MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL.

The following packages have been upgraded to a later upstream version: mariadb (10.3.27), galera (25.3.31). (BZ#1899082, BZ#1899086)

Security Fix(es):

  • mariadb: Insufficient SST method name check leading to code injection in mysql-wsrep (CVE-2020-15180)

  • mysql: InnoDB unspecified vulnerability (CPU Oct 2019) (CVE-2019-2938)

  • mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2019) (CVE-2019-2974)

  • mysql: C API unspecified vulnerability (CPU Apr 2020) (CVE-2020-2752)

  • mysql: InnoDB unspecified vulnerability (CPU Apr 2020) (CVE-2020-2760)

  • mysql: Server: DML unspecified vulnerability (CPU Apr 2020) (CVE-2020-2780)

  • mysql: Server: Stored Procedure unspecified vulnerability (CPU Apr 2020) (CVE-2020-2812)

  • mysql: InnoDB unspecified vulnerability (CPU Apr 2020) (CVE-2020-2814)

  • mariadb-connector-c: Improper validation of content in a OK packet received from server (CVE-2020-13249)

  • mysql: Server: FTS unspecified vulnerability (CPU Oct 2020) (CVE-2020-14765)

  • mysql: InnoDB unspecified vulnerability (CPU Oct 2020) (CVE-2020-14776)

  • mysql: Server: FTS unspecified vulnerability (CPU Oct 2020) (CVE-2020-14789)

  • mysql: Server: Locking unspecified vulnerability (CPU Oct 2020) (CVE-2020-14812)

  • mysql: C API unspecified vulnerability (CPU Jan 2020) (CVE-2020-2574)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

  • FTBFS: -D_GLIBCXX_ASSERTIONS (BZ#1899009)

  • Queries with entity_id IN ('1', '2', …, '70000') run much slower in MariaDB 10.3 than on MariaDB 10.1 (BZ#1899017)

  • Cleanup race with wsrep_rsync_sst_tunnel may prevent full galera cluster bootstrap (BZ#1899021)

  • There are undeclared file conflicts in several mariadb and mysql packages (BZ#1899077)

References
https://access.redhat.com/errata/RHSA-2020:5500 ADVISORY
https://bugzilla.redhat.com/1764680 REPORT
https://bugzilla.redhat.com/1764691 REPORT
https://bugzilla.redhat.com/1798587 REPORT
https://bugzilla.redhat.com/1830056 REPORT
https://bugzilla.redhat.com/1830059 REPORT
https://bugzilla.redhat.com/1830060 REPORT
https://bugzilla.redhat.com/1830082 REPORT
https://bugzilla.redhat.com/1835849 REPORT
https://bugzilla.redhat.com/1839827 REPORT
https://bugzilla.redhat.com/1890738 REPORT
https://bugzilla.redhat.com/1890743 REPORT
https://bugzilla.redhat.com/1890747 REPORT
https://bugzilla.redhat.com/1890756 REPORT
https://bugzilla.redhat.com/1894919 REPORT
https://bugzilla.redhat.com/1899009 REPORT
https://bugzilla.redhat.com/1899017 REPORT
https://bugzilla.redhat.com/1899021 REPORT
https://bugzilla.redhat.com/1899082 REPORT
https://bugzilla.redhat.com/1899086 REPORT
https://bugzilla.redhat.com/1922389 REPORT
https://bugzilla.redhat.com/1951749 REPORT
https://bugzilla.redhat.com/1951764 REPORT
https://errata.almalinux.org/8/ALSA-2020-5500.html ADVISORY
https://vulners.com/cve/CVE-2019-2938 REPORT
https://vulners.com/cve/CVE-2019-2974 REPORT
https://vulners.com/cve/CVE-2020-13249 REPORT
https://vulners.com/cve/CVE-2020-14765 REPORT
https://vulners.com/cve/CVE-2020-14776 REPORT
https://vulners.com/cve/CVE-2020-14789 REPORT
https://vulners.com/cve/CVE-2020-14812 REPORT
https://vulners.com/cve/CVE-2020-15180 REPORT
https://vulners.com/cve/CVE-2020-2574 REPORT
https://vulners.com/cve/CVE-2020-2752 REPORT
https://vulners.com/cve/CVE-2020-2760 REPORT
https://vulners.com/cve/CVE-2020-2780 REPORT
https://vulners.com/cve/CVE-2020-2812 REPORT
https://vulners.com/cve/CVE-2020-2814 REPORT
https://vulners.com/cve/CVE-2021-2022 REPORT
https://vulners.com/cve/CVE-2021-2144 REPORT
https://vulners.com/cve/CVE-2021-2194 REPORT
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "Judy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.5-18.module_el8.6.0+2867+72759d2f"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "Judy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.5-18.module_el8.5.0+2632+14ced695"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "Judy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.5-18.module_el8.6.0+2761+593e5e59"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL. \n\nThe following packages have been upgraded to a later upstream version: mariadb (10.3.27), galera (25.3.31). (BZ#1899082, BZ#1899086)\n\nSecurity Fix(es):\n\n* mariadb: Insufficient SST method name check leading to code injection in mysql-wsrep (CVE-2020-15180)\n\n* mysql: InnoDB unspecified vulnerability (CPU Oct 2019) (CVE-2019-2938)\n\n* mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2019) (CVE-2019-2974)\n\n* mysql: C API unspecified vulnerability (CPU Apr 2020) (CVE-2020-2752)\n\n* mysql: InnoDB unspecified vulnerability (CPU Apr 2020) (CVE-2020-2760)\n\n* mysql: Server: DML unspecified vulnerability (CPU Apr 2020) (CVE-2020-2780)\n\n* mysql: Server: Stored Procedure unspecified vulnerability (CPU Apr 2020) (CVE-2020-2812)\n\n* mysql: InnoDB unspecified vulnerability (CPU Apr 2020) (CVE-2020-2814)\n\n* mariadb-connector-c: Improper validation of content in a OK packet received from server (CVE-2020-13249)\n\n* mysql: Server: FTS unspecified vulnerability (CPU Oct 2020) (CVE-2020-14765)\n\n* mysql: InnoDB unspecified vulnerability (CPU Oct 2020) (CVE-2020-14776)\n\n* mysql: Server: FTS unspecified vulnerability (CPU Oct 2020) (CVE-2020-14789)\n\n* mysql: Server: Locking unspecified vulnerability (CPU Oct 2020) (CVE-2020-14812)\n\n* mysql: C API unspecified vulnerability (CPU Jan 2020) (CVE-2020-2574)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* FTBFS: -D_GLIBCXX_ASSERTIONS (BZ#1899009)\n\n* Queries with entity_id IN (\u00271\u0027, \u00272\u0027, \u2026, \u002770000\u0027) run much slower in MariaDB 10.3 than on MariaDB 10.1 (BZ#1899017)\n\n* Cleanup race with wsrep_rsync_sst_tunnel may prevent full galera cluster bootstrap (BZ#1899021)\n\n* There are undeclared file conflicts in several mariadb and mysql packages (BZ#1899077)",
  "id": "ALSA-2020:5500",
  "modified": "2026-11-02T01:59:18Z",
  "published": "2020-12-15T16:03:43Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://access.redhat.com/errata/RHSA-2020:5500"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1764680"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1764691"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1798587"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1830056"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1830059"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1830060"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1830082"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1835849"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1839827"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1890738"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1890743"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1890747"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1890756"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1894919"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1899009"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1899017"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1899021"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1899082"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1899086"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1922389"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1951749"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1951764"
    },
    {
      "type": "ADVISORY",
      "url": "https://errata.almalinux.org/8/ALSA-2020-5500.html"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2019-2938"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2019-2974"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2020-13249"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2020-14765"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2020-14776"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2020-14789"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2020-14812"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2020-15180"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2020-2574"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2020-2752"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2020-2760"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2020-2780"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2020-2812"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2020-2814"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2021-2022"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2021-2144"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2021-2194"
    }
  ],
  "related": [
    "CVE-2019-2938",
    "CVE-2019-2974",
    "CVE-2020-13249",
    "CVE-2020-14765",
    "CVE-2020-14776",
    "CVE-2020-14789",
    "CVE-2020-14812",
    "CVE-2020-15180",
    "CVE-2020-2574",
    "CVE-2020-2752",
    "CVE-2020-2760",
    "CVE-2020-2780",
    "CVE-2020-2812",
    "CVE-2020-2814",
    "CVE-2021-2022",
    "CVE-2021-2144",
    "CVE-2021-2194"
  ],
  "schema_version": "1.7.0",
  "summary": "Important: mariadb:10.3 security, bug fix, and enhancement update",
  "upstream": [
    "CVE-2019-2938",
    "CVE-2019-2974",
    "CVE-2020-13249",
    "CVE-2020-14765",
    "CVE-2020-14776",
    "CVE-2020-14789",
    "CVE-2020-14812",
    "CVE-2020-15180",
    "CVE-2020-2574",
    "CVE-2020-2752",
    "CVE-2020-2760",
    "CVE-2020-2780",
    "CVE-2020-2812",
    "CVE-2020-2814",
    "CVE-2021-2022",
    "CVE-2021-2144",
    "CVE-2021-2194"
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON
How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.