Bug 1112407 (CVE-2018-3137)

Summary: VUL-0: CVE-2018-3137: mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2018)
Product: [Novell Products] SUSE Security Incidents Reporter: Karol Babioch <karol>
Component: IncidentsAssignee: Kristyna Streitova <kstreitova>
Status: RESOLVED INVALID QA Contact: Security Team bot <security-team>
Severity: Normal    
Priority: P5 - None CC: smash_bz
Version: unspecified   
Target Milestone: ---   
Hardware: Other   
OS: Other   
URL: https://smash.suse.de/issue/216729/
Whiteboard:
Found By: Security Response Team Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---

Description Karol Babioch 2018-10-18 13:47:57 UTC
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 8.0.12 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.

External References:
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1640309
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-3137
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html#CVE-2018-3137
http://people.canonical.com/~ubuntu-security/cve/2018/CVE-2018-3137.html
Comment 1 Karol Babioch 2018-10-18 13:48:25 UTC
We only ship 5.5.x, so this does not affect us.