Bugzilla – Bug 1200484
VUL-0: CVE-2022-26944: xtrabackup: Information exposure via cmd line output and table history into backup file
Last modified: 2022-07-18 06:56:42 UTC
rh#2093149 Percona XtraBackup 2.4.20 unintentionally writes the command line to any resulting backup file output. This may include sensitive arguments passed at run time. In addition, when --history is passed at run time, this command line is also written to the PERCONA_SCHEMA.xtrabackup_history table. NOTE: this issue exists because of an incomplete fix for CVE-2020-10997. https://docs.percona.com/percona-xtrabackup/2.4/release-notes/2.4/2.4.25.html https://jira.percona.com/browse/PXB-2722 References: https://bugzilla.redhat.com/show_bug.cgi?id=2093149 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-26944 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-26944 https://docs.percona.com/percona-xtrabackup/2.4/release-notes/2.4/2.4.25.html https://jira.percona.com/browse/PXB-2722
It seems that this bug was introduced in the fix for CVE-2020-10997 bsc#1170644. As long as CVE-2020-10997 remains unfixed, we are not affected.