Bug 1112409 (CVE-2018-3171)

Summary: VUL-0: CVE-2018-3171: mysql: Server: Partition unspecified vulnerability (CPU Oct 2018)
Product: [Novell Products] SUSE Security Incidents Reporter: Karol Babioch <karol>
Component: IncidentsAssignee: Kristyna Streitova <kstreitova>
Status: RESOLVED FIXED QA Contact: Security Team bot <security-team>
Severity: Normal    
Priority: P5 - None CC: smash_bz
Version: unspecified   
Target Milestone: ---   
Hardware: Other   
OS: Other   
URL: https://smash.suse.de/issue/216760/
Whiteboard: CVSSv2:NVD:CVE-2018-3171:4.9:(AV:N/AC:M/Au:S/C:N/I:P/A:P) CVSSv3:NVD:CVE-2018-3171:5.0:(AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H) CVSSv3:RedHat:CVE-2018-3171:5.0:(AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H) CVSSv3:UNK(Oracle):CVE-2018-3171:5.0:(AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H)
Found By: Security Response Team Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---

Description Karol Babioch 2018-10-18 13:50:51 UTC 
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Partition). Supported versions that are affected are 5.7.23 and prior and 8.0.12 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data.

External References:
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1640334
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-3171
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html#CVE-2018-3171
http://people.canonical.com/~ubuntu-security/cve/2018/CVE-2018-3171.html
Comment 1 Karol Babioch 2018-10-18 13:54:25 UTC 
We only ship 5.5.x, so this does not affect us.