934789 – VUL-0: mariadb/mysql: Logjam Attack: mysql uses 512 bit dh groups in SSL

Bug 934789 - VUL-0: mariadb/mysql: Logjam Attack: mysql uses 512 bit dh groups in SSL

Summary: VUL-0: mariadb/mysql: Logjam Attack: mysql uses 512 bit dh groups in SSL

Status:	RESOLVED FIXED
Duplicates (1):	936888 (view as bug list)

Alias:	None

Product:	SUSE Security Incidents
Classification:	Novell Products
Component:	Incidents (show other bugs)
Version:	unspecified
Hardware:	Other Other

Priority:	P3 - Medium Severity: Major
Target Milestone:	---
Deadline:	2015-07-03
Assignee:	Security Team bot
QA Contact:	Security Team bot

URL:
Whiteboard:	maint:released:sle11-sp3:62153 maint:...
Keywords:

Depends on:	CVE-2015-4000
Blocks:
	Show dependency tree / graph

Clone This Bug

Reported:	2015-06-15 18:23 UTC by Marcus Meissner
Modified:	2023-12-29 12:30 UTC (History)
CC List:	17 users (show)

See Also:
Found By:	---
Services Priority:
Business Priority:
Blocker:	---
Marketing QA Status:	---
IT Deployment:	---

Attachments
patch for mysql 5.5.43 in SLE11SP3 (4.89 KB, patch) 2015-06-30 09:31 UTC, Kristyna Streitova	Details \| Diff
patch for mysql 5.0.96 in SLE11SP1 (4.57 KB, patch) 2015-06-30 09:33 UTC, Kristyna Streitova	Details \| Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Marcus Meissner 2015-06-15 18:23:30 UTC

+++ This bug was initially created as a clone of Bug #931600 +++

SUSE:SLE-12:Update/mariadb/mariadb-10.0.16

grep -r SSL_CTX_set_tmp_dh .
./extra/yassl/src/yassl.cpp:    SSL_CTX_set_tmp_dh(base.ctx_, base.dh_);
      uses fixed 512 bit group - BAD

./extra/yassl/src/ssl.cpp:long SSL_CTX_set_tmp_dh(SSL_CTX* ctx, DH* dh)


./extra/yassl/testsuite/test.hpp:    SSL_CTX_set_tmp_dh(ctx, dh);

      fixed 1024bit group - OK

./extra/yassl/include/openssl/ssl.h:long SSL_CTX_set_tmp_dh(SSL_CTX*, DH*);

./extra/yassl/include/openssl/prefix_ssl.h:#define SSL_CTX_set_tmp_dh yaSSL_CTX_set_tmp_dh


./vio/viosslfactories.c:  SSL_CTX_set_tmp_dh(ssl_fd->ssl_context, dh);


  /* DH stuff */
  dh=get_dh512();
  SSL_CTX_set_tmp_dh(ssl_fd->ssl_context, dh);

  - BAD

Comment 1 Marcus Meissner 2015-06-15 18:24:48 UTC

mysql 5.5 has the same code.

Comment 2 Marcus Meissner 2015-06-15 18:26:10 UTC

after our current openssl update, accessing mysql with our tools will probably no longer work.

Comment 3 Swamp Workflow Management 2015-06-15 22:00:37 UTC

bugbot adjusting priority

Comment 4 Marcus Meissner 2015-06-26 08:59:26 UTC

https://github.com/mysql/mysql-server/commit/866b988a76e8e7e217017a7883a52a12ec5024b9

https://mariadb.atlassian.net/browse/MDEV-7695

Comment 5 Swamp Workflow Management 2015-06-26 09:02:34 UTC

An update workflow for this issue was started.
This issue was rated as important.
Please submit fixed packages until 2015-07-03.
When done, reassign the bug to security-team@suse.de.
https://swamp.suse.de/webswamp/wf/62129

Comment 6 Marcus Meissner 2015-06-26 09:03:42 UTC

Krystina, can you submit fixed mariadb for SLES 12
and mysql for SLES 11 SP3, and also backport the patch to SLES 11 SP1?

Comment 7 Marcus Meissner 2015-06-26 09:06:56 UTC

also for openSUSE please

Comment 10 Kristyna Streitova 2015-06-30 09:31:26 UTC

Created attachment 639632 [details]
patch for mysql 5.5.43 in SLE11SP3

Adding patch for mysql 5.5.43 in SLE11SP3

Comment 11 Kristyna Streitova 2015-06-30 09:33:58 UTC

Created attachment 639633 [details]
patch for mysql 5.0.96 in SLE11SP1

Adding patch for mysql 5.0.96 in SLE11SP1

Comment 12 Kristyna Streitova 2015-06-30 09:44:35 UTC

Patches for mysql submitted:

SLE11SP1: https://build.suse.de/request/show/61286
SLE11SP3: https://build.suse.de/request/show/61288

Comment 13 Bernhard Wiedemann 2015-06-30 12:00:11 UTC

This is an autogenerated message for OBS integration:
This bug (934789) was mentioned in
https://build.opensuse.org/request/show/314500 13.2+13.1 / mariadb

Comment 14 Bernhard Wiedemann 2015-06-30 14:00:09 UTC

This is an autogenerated message for OBS integration:
This bug (934789) was mentioned in
https://build.opensuse.org/request/show/314519 13.2+13.1 / mysql-community-server

Comment 15 Kristyna Streitova 2015-06-30 17:29:01 UTC

MariaDB 10.0.20 submitted to SLE12.

-----

Submission overview:

MySQL
|    Product    | Affected |  Request  |
|---------------|----------|-----------|
| SLE11SP1      | yes      | mr#61286  |
| SLE11SP3      | yes      | mr#61288  |
| openSUSE 13.1 | yes      | mr#314519 |
| openSUSE 13.2 | yes      | mr#314519 |
| devel/Factory | yes      | sr#314497 |


MariaDB
|    Product    | Affected |  Request  |
|---------------|----------|-----------|
| SLE12         | yes      | mr#61330  |
| openSUSE 13.1 | yes      | mr#314500 |
| openSUSE 13.2 | yes      | mr#314500 |
| devel/Factory | no*      | ---       |

* 10.0.20 already present here


Reassigning to security team.

Comment 18 Andreas Stieger 2015-07-02 14:05:31 UTC

*** Bug 936888 has been marked as a duplicate of this bug. ***

Comment 19 Peter Szaban 2015-07-02 15:00:29 UTC

Hello,
    I originally opened bug #936888, which was marked as a duplicate.  I installed mariadb and libmysql 5.5.44-4.1 as suggested from http://download.opensuse.org/update/13.1-test/x86_64/ and after restarting the mysqld process, the problem has been resolved for me.
               THANK YOU!!

Comment 20 Swamp Workflow Management 2015-07-02 19:05:29 UTC

SUSE-SU-2015:1177-1: An update that fixes one vulnerability is now available.

Category: security (important)
Bug References: 934789
CVE References: CVE-2015-4000
Sources used:
SUSE Linux Enterprise Software Development Kit 11 SP3 (src):    mysql-5.0.96-0.8.8.1, mysql-5.5.43-0.9.1
SUSE Linux Enterprise Server 11 SP3 for VMware (src):    mysql-5.0.96-0.8.8.1, mysql-5.5.43-0.9.1
SUSE Linux Enterprise Server 11 SP3 (src):    mysql-5.0.96-0.8.8.1, mysql-5.5.43-0.9.1
SUSE Linux Enterprise Desktop 11 SP3 (src):    mysql-5.0.96-0.8.8.1, mysql-5.5.43-0.9.1

Comment 21 Swamp Workflow Management 2015-07-08 16:08:49 UTC

openSUSE-SU-2015:1209-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 934789
CVE References: CVE-2015-4000
Sources used:
openSUSE 13.2 (src):    mysql-community-server-5.6.25-2.3.1
openSUSE 13.1 (src):    mysql-community-server-5.6.25-7.4.1

Comment 22 Swamp Workflow Management 2015-07-09 15:08:50 UTC

openSUSE-SU-2015:1216-1: An update that fixes 28 vulnerabilities is now available.

Category: security (important)
Bug References: 859345,914370,924663,934789,936407,936408,936409
CVE References: CVE-2014-6464,CVE-2014-6469,CVE-2014-6491,CVE-2014-6494,CVE-2014-6496,CVE-2014-6500,CVE-2014-6507,CVE-2014-6555,CVE-2014-6559,CVE-2014-6568,CVE-2014-8964,CVE-2015-0374,CVE-2015-0381,CVE-2015-0382,CVE-2015-0411,CVE-2015-0432,CVE-2015-0433,CVE-2015-0441,CVE-2015-0499,CVE-2015-0501,CVE-2015-0505,CVE-2015-2325,CVE-2015-2326,CVE-2015-2568,CVE-2015-2571,CVE-2015-2573,CVE-2015-3152,CVE-2015-4000
Sources used:
openSUSE 13.2 (src):    mariadb-10.0.20-2.9.1
openSUSE 13.1 (src):    mariadb-5.5.44-4.1

Comment 23 Swamp Workflow Management 2015-07-10 17:08:07 UTC

SUSE-SU-2015:1177-2: An update that fixes one vulnerability is now available.

Category: security (important)
Bug References: 934789
CVE References: CVE-2015-4000
Sources used:
SUSE Linux Enterprise Server 11 SP2 LTSS (src):    mysql-5.0.96-0.8.8.2
SUSE Linux Enterprise Server 11 SP1 LTSS (src):    mysql-5.0.96-0.8.8.2

Comment 24 Olivier Nicolas 2015-07-12 11:11:06 UTC

After updating to "mysql-community-server-client-5.6.25-7.4.1.i586" on "openSUSE 13.1 (Bottle) (i586)"

The mysql server keeps restarting every minute 

Jul  9 19:00:11 blackened systemd[1]: Reloaded System Logging Service.
Jul  9 19:00:57 blackened mysql-systemd-helper[337]: MySQL is still dead
Jul  9 19:00:57 blackened systemd[1]: mysql.service: control process exited, code=exited status=1
Jul  9 19:00:57 blackened systemd[1]: Failed to start MySQL server.
Jul  9 19:00:57 blackened systemd[1]: Unit mysql.service entered failed state.
Jul  9 19:00:57 blackened mysql-systemd-helper[335]: 2015-07-09 19:00:57 351 [Note] /usr/sbin/mysqld: Normal shutdown
Jul  9 19:00:57 blackened mysql-systemd-helper[335]: 2015-07-09 19:00:57 351 [Note] Giving 2 client threads a chance to die gracefully
Jul  9 19:00:57 blackened mysql-systemd-helper[335]: 2015-07-09 19:00:57 351 [Note] Event Scheduler: Purging the queue. 0 events
Jul  9 19:00:57 blackened mysql-systemd-helper[335]: 2015-07-09 19:00:57 351 [Note] Shutting down slave threads
Jul  9 19:00:57 blackened systemd[1]: mysql.service holdoff time over, scheduling restart.
Jul  9 19:00:57 blackened systemd[1]: Stopping MySQL server...
Jul  9 19:00:57 blackened systemd[1]: Starting MySQL server...
Jul  9 19:00:57 blackened mysql-systemd-helper[1042]: /usr/bin/my_print_defaults: unknown option '--mysqld'
Jul  9 19:00:57 blackened mysql-systemd-helper[1051]: /usr/bin/my_print_defaults: unknown option '--mysqld'
Jul  9 19:00:57 blackened mysql-systemd-helper[1059]: /usr/bin/my_print_defaults: unknown option '--mysqld'
Jul  9 19:00:57 blackened mysql-systemd-helper[1060]: /usr/bin/my_print_defaults: unknown option '--mysqld'
Jul  9 19:00:57 blackened mysql-systemd-helper[1060]: Waiting for MySQL to start


I had to modify the /usr/lib/mysql/mysql-systemd-helper to successfully start the mysql server 


--- /usr/lib/mysql/mysql-systemd-helper.orig	2015-07-12 11:46:47.071715464 +0200
+++ /usr/lib/mysql/mysql-systemd-helper	2015-07-12 11:47:22.631715464 +0200
@@ -20,10 +20,10 @@
 
 	# Read options - important for multi setup
 	if [[ -n "$INSTANCE" && "x$INSTANCE" != "xdefault" ]]; then
-		opts="$(/usr/bin/my_print_defaults --mysqld mysqld_multi "$INSTANCE")"
+		opts="$(/usr/bin/my_print_defaults mysqld mysqld_multi "$INSTANCE")"
 		tmp_opts="$opts"
 	else
-		opts="$(/usr/bin/my_print_defaults --mysqld)"
+		opts="$(/usr/bin/my_print_defaults mysqld)"
 		tmp_opts="$opts"
 	fi

Comment 25 Andreas Stieger 2015-07-12 20:07:39 UTC

(In reply to Olivier Nicolas from comment #24)
> After updating to "mysql-community-server-client-5.6.25-7.4.1.i586" on
> "openSUSE 13.1 (Bottle) (i586)"
> 
> The mysql server keeps restarting every minute 

Copied to bug 937767, handling there.

Comment 26 Marcus Meissner 2015-07-21 10:54:37 UTC

sle12 mariadb is still in qa.

Comment 27 Andreas Stieger 2015-07-21 12:07:23 UTC

Releasing MariaDB for SLE 12

Comment 28 Swamp Workflow Management 2015-07-21 14:09:59 UTC

SUSE-SU-2015:1273-1: An update that solves 12 vulnerabilities and has one errata is now available.

Category: security (important)
Bug References: 906574,919053,919062,920865,920896,921333,924663,924960,924961,934789,936407,936408,936409
CVE References: CVE-2014-8964,CVE-2015-0433,CVE-2015-0441,CVE-2015-0499,CVE-2015-0501,CVE-2015-0505,CVE-2015-2325,CVE-2015-2326,CVE-2015-2568,CVE-2015-2571,CVE-2015-2573,CVE-2015-3152
Sources used:
SUSE Linux Enterprise Workstation Extension 12 (src):    mariadb-10.0.20-18.1
SUSE Linux Enterprise Software Development Kit 12 (src):    mariadb-10.0.20-18.1
SUSE Linux Enterprise Server 12 (src):    mariadb-10.0.20-18.1
SUSE Linux Enterprise Desktop 12 (src):    mariadb-10.0.20-18.1

Comment 30 Swamp Workflow Management 2016-06-17 18:08:16 UTC

SUSE-SU-2016:1618-1: An update that solves one vulnerability and has one errata is now available.

Category: security (moderate)
Bug References: 934789,959724
CVE References: CVE-2015-4000
Sources used:
SUSE Linux Enterprise Software Development Kit 11-SP4 (src):    mysql-5.0.96-0.8.10.3
SUSE Linux Enterprise Server 11-SP4 (src):    mysql-5.0.96-0.8.10.3

Comment 31 Maintenance Automation 2023-10-04 08:33:48 UTC

SUSE-RU-2023:3956-1: An update that solves 221 vulnerabilities and contains three features can now be installed.

Category: recommended (moderate)
Bug References: 1001367, 1005555, 1005558, 1005562, 1005564, 1005566, 1005569, 1005581, 1005582, 1006539, 1008253, 1012075, 1013882, 1019948, 1020873, 1020875, 1020877, 1020878, 1020882, 1020884, 1020885, 1020890, 1020891, 1020894, 1020896, 1020976, 1022428, 1038740, 1039034, 1041525, 1041891, 1042632, 1043328, 1047218, 1055165, 1055268, 1058374, 1058729, 1060110, 1062583, 1067443, 1068906, 1069401, 1080891, 1083087, 1088681, 1092544, 1098683, 1101676, 1101677, 1101678, 1103342, 1111858, 1111859, 1112368, 1112377, 1112384, 1112386, 1112391, 1112397, 1112404, 1112415, 1112417, 1112421, 1112432, 1112767, 1116686, 1118754, 1120041, 1122198, 1122475, 1127027, 1132666, 1136035, 1142909, 1143215, 1144314, 1156669, 1160285, 1160868, 1160878, 1160883, 1160895, 1160912, 1166781, 1168380, 1170204, 1173028, 1173516, 1174559, 1175596, 1177472, 1178428, 1180014, 1182218, 1182255, 1182739, 1183770, 1185870, 1185872, 1186031, 1189320, 1192497, 1195325, 1195334, 1195339, 1196016, 1197459, 1198603, 1198604, 1198605, 1198606, 1198607, 1198609, 1198610, 1198611, 1198612, 1198613, 1198628, 1198629, 1198630, 1198631, 1198632, 1198633, 1198634, 1198635, 1198636, 1198637, 1198638, 1198639, 1198640, 1199928, 1200105, 1201161, 1201163, 1201164, 1201165, 1201166, 1201167, 1201168, 1201169, 1201170, 1202863, 332530, 353120, 357634, 359522, 366820, 371000, 387746, 420313, 425079, 427384, 429618, 435519, 437293, 463586, 520876, 525065, 525325, 539243, 539249, 557669, 635645, 747811, 763150, 779476, 789263, 792444, 796164, 829430, 841709, 859345, 889126, 894479, 902396, 914370, 921955, 934789, 937754, 937767, 937787, 942908, 943096, 957174, 963810, 971456, 979524, 983938, 984858, 986251, 989913, 989919, 989922, 989926, 990890, 998309
CVE References: CVE-2006-0903, CVE-2006-4226, CVE-2006-4227, CVE-2007-5969, CVE-2007-5970, CVE-2007-6303, CVE-2007-6304, CVE-2008-2079, CVE-2008-7247, CVE-2009-4019, CVE-2009-4028, CVE-2009-4030, CVE-2012-4414, CVE-2012-5611, CVE-2012-5612, CVE-2012-5615, CVE-2012-5627, CVE-2013-1976, CVE-2015-4792, CVE-2015-4802, CVE-2015-4807, CVE-2015-4815, CVE-2015-4816, CVE-2015-4819, CVE-2015-4826, CVE-2015-4830, CVE-2015-4836, CVE-2015-4858, CVE-2015-4861, CVE-2015-4864, CVE-2015-4866, CVE-2015-4870, CVE-2015-4879, CVE-2015-4895, CVE-2015-4913, CVE-2015-5969, CVE-2015-7744, CVE-2016-0505, CVE-2016-0546, CVE-2016-0596, CVE-2016-0597, CVE-2016-0598, CVE-2016-0600, CVE-2016-0606, CVE-2016-0608, CVE-2016-0609, CVE-2016-0610, CVE-2016-0616, CVE-2016-0640, CVE-2016-0641, CVE-2016-0642, CVE-2016-0644, CVE-2016-0646, CVE-2016-0649, CVE-2016-0650, CVE-2016-0651, CVE-2016-0668, CVE-2016-2047, CVE-2016-3477, CVE-2016-3492, CVE-2016-3521, CVE-2016-3615, CVE-2016-5440, CVE-2016-5584, CVE-2016-5616, CVE-2016-5624, CVE-2016-5626, CVE-2016-5629, CVE-2016-6662, CVE-2016-6663, CVE-2016-6664, CVE-2016-7440, CVE-2016-8283, CVE-2016-9843, CVE-2017-10268, CVE-2017-10286, CVE-2017-10320, CVE-2017-10365, CVE-2017-10378, CVE-2017-10379, CVE-2017-10384, CVE-2017-15365, CVE-2017-3238, CVE-2017-3243, CVE-2017-3244, CVE-2017-3257, CVE-2017-3258, CVE-2017-3265, CVE-2017-3291, CVE-2017-3302, CVE-2017-3308, CVE-2017-3309, CVE-2017-3312, CVE-2017-3313, CVE-2017-3317, CVE-2017-3318, CVE-2017-3453, CVE-2017-3456, CVE-2017-3464, CVE-2017-3636, CVE-2017-3641, CVE-2017-3653, CVE-2018-25032, CVE-2018-2562, CVE-2018-2612, CVE-2018-2622, CVE-2018-2640, CVE-2018-2665, CVE-2018-2668, CVE-2018-2755, CVE-2018-2759, CVE-2018-2761, CVE-2018-2766, CVE-2018-2767, CVE-2018-2771, CVE-2018-2777, CVE-2018-2781, CVE-2018-2782, CVE-2018-2784, CVE-2018-2786, CVE-2018-2787, CVE-2018-2810, CVE-2018-2813, CVE-2018-2817, CVE-2018-2819, CVE-2018-3058, CVE-2018-3060, CVE-2018-3063, CVE-2018-3064, CVE-2018-3066, CVE-2018-3143, CVE-2018-3156, CVE-2018-3162, CVE-2018-3173, CVE-2018-3174, CVE-2018-3185, CVE-2018-3200, CVE-2018-3251, CVE-2018-3277, CVE-2018-3282, CVE-2018-3284, CVE-2019-18901, CVE-2019-2510, CVE-2019-2537, CVE-2019-2614, CVE-2019-2627, CVE-2019-2628, CVE-2019-2737, CVE-2019-2739, CVE-2019-2740, CVE-2019-2758, CVE-2019-2805, CVE-2019-2938, CVE-2019-2974, CVE-2020-13249, CVE-2020-14765, CVE-2020-14776, CVE-2020-14789, CVE-2020-14812, CVE-2020-15180, CVE-2020-2574, CVE-2020-2752, CVE-2020-2760, CVE-2020-2812, CVE-2020-2814, CVE-2020-7221, CVE-2021-2154, CVE-2021-2166, CVE-2021-2372, CVE-2021-2389, CVE-2021-27928, CVE-2021-35604, CVE-2021-46657, CVE-2021-46658, CVE-2021-46659, CVE-2021-46661, CVE-2021-46663, CVE-2021-46664, CVE-2021-46665, CVE-2021-46668, CVE-2021-46669, CVE-2022-21427, CVE-2022-21595, CVE-2022-24048, CVE-2022-24050, CVE-2022-24051, CVE-2022-24052, CVE-2022-27376, CVE-2022-27377, CVE-2022-27378, CVE-2022-27379, CVE-2022-27380, CVE-2022-27381, CVE-2022-27382, CVE-2022-27383, CVE-2022-27384, CVE-2022-27386, CVE-2022-27387, CVE-2022-27444, CVE-2022-27445, CVE-2022-27446, CVE-2022-27447, CVE-2022-27448, CVE-2022-27449, CVE-2022-27451, CVE-2022-27452, CVE-2022-27455, CVE-2022-27456, CVE-2022-27457, CVE-2022-27458, CVE-2022-32081, CVE-2022-32083, CVE-2022-32084, CVE-2022-32085, CVE-2022-32086, CVE-2022-32087, CVE-2022-32088, CVE-2022-32089, CVE-2022-32091, CVE-2022-38791, CVE-2022-47015
Jira References: PED-2455, SLE-12253, SLE-8269
Sources used:
SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS 15-SP1 (src): mariadb104-10.4.30-150100.3.5.10, python-mysqlclient-1.4.6-150100.3.3.7
SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1 (src): mariadb104-10.4.30-150100.3.5.10, python-mysqlclient-1.4.6-150100.3.3.7
SUSE Linux Enterprise Server for SAP Applications 15 SP1 (src): mariadb104-10.4.30-150100.3.5.10, python-mysqlclient-1.4.6-150100.3.3.7
SUSE CaaS Platform 4.0 (src): mariadb104-10.4.30-150100.3.5.10, python-mysqlclient-1.4.6-150100.3.3.7

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 32 Maintenance Automation 2023-12-29 12:30:32 UTC

SUSE-RU-2023:4991-1: An update that solves 221 vulnerabilities and contains three features can now be installed.

Category: recommended (moderate)
Bug References: 1001367, 1005555, 1005558, 1005562, 1005564, 1005566, 1005569, 1005581, 1005582, 1006539, 1008253, 1012075, 1013882, 1019948, 1020873, 1020875, 1020877, 1020878, 1020882, 1020884, 1020885, 1020890, 1020891, 1020894, 1020896, 1020976, 1022428, 1038740, 1039034, 1041525, 1041891, 1042632, 1043328, 1047218, 1055165, 1055268, 1058374, 1058729, 1060110, 1062583, 1067443, 1068906, 1069401, 1080891, 1083087, 1088681, 1092544, 1098683, 1101676, 1101677, 1101678, 1103342, 1111858, 1111859, 1112368, 1112377, 1112384, 1112386, 1112391, 1112397, 1112404, 1112415, 1112417, 1112421, 1112432, 1112767, 1116686, 1118754, 1120041, 1122198, 1122475, 1127027, 1132666, 1136035, 1142909, 1143215, 1144314, 1156669, 1160285, 1160868, 1160878, 1160883, 1160895, 1160912, 1166781, 1168380, 1170204, 1173028, 1173516, 1174559, 1175596, 1177472, 1178428, 1180014, 1182218, 1182255, 1182739, 1183770, 1185870, 1185872, 1186031, 1189320, 1192497, 1195325, 1195334, 1195339, 1196016, 1197459, 1198603, 1198604, 1198605, 1198606, 1198607, 1198609, 1198610, 1198611, 1198612, 1198613, 1198628, 1198629, 1198630, 1198631, 1198632, 1198633, 1198634, 1198635, 1198636, 1198637, 1198638, 1198639, 1198640, 1199928, 1200105, 1201161, 1201163, 1201164, 1201165, 1201166, 1201167, 1201168, 1201169, 1201170, 1202863, 332530, 353120, 357634, 359522, 366820, 371000, 387746, 420313, 425079, 427384, 429618, 435519, 437293, 463586, 520876, 525065, 525325, 539243, 539249, 557669, 635645, 747811, 763150, 779476, 789263, 792444, 796164, 829430, 841709, 859345, 889126, 894479, 902396, 914370, 921955, 934789, 937754, 937767, 937787, 942908, 943096, 957174, 963810, 971456, 979524, 983938, 984858, 986251, 989913, 989919, 989922, 989926, 990890, 998309
CVE References: CVE-2006-0903, CVE-2006-4226, CVE-2006-4227, CVE-2007-5969, CVE-2007-5970, CVE-2007-6303, CVE-2007-6304, CVE-2008-2079, CVE-2008-7247, CVE-2009-4019, CVE-2009-4028, CVE-2009-4030, CVE-2012-4414, CVE-2012-5611, CVE-2012-5612, CVE-2012-5615, CVE-2012-5627, CVE-2013-1976, CVE-2015-4792, CVE-2015-4802, CVE-2015-4807, CVE-2015-4815, CVE-2015-4816, CVE-2015-4819, CVE-2015-4826, CVE-2015-4830, CVE-2015-4836, CVE-2015-4858, CVE-2015-4861, CVE-2015-4864, CVE-2015-4866, CVE-2015-4870, CVE-2015-4879, CVE-2015-4895, CVE-2015-4913, CVE-2015-5969, CVE-2015-7744, CVE-2016-0505, CVE-2016-0546, CVE-2016-0596, CVE-2016-0597, CVE-2016-0598, CVE-2016-0600, CVE-2016-0606, CVE-2016-0608, CVE-2016-0609, CVE-2016-0610, CVE-2016-0616, CVE-2016-0640, CVE-2016-0641, CVE-2016-0642, CVE-2016-0644, CVE-2016-0646, CVE-2016-0649, CVE-2016-0650, CVE-2016-0651, CVE-2016-0668, CVE-2016-2047, CVE-2016-3477, CVE-2016-3492, CVE-2016-3521, CVE-2016-3615, CVE-2016-5440, CVE-2016-5584, CVE-2016-5616, CVE-2016-5624, CVE-2016-5626, CVE-2016-5629, CVE-2016-6662, CVE-2016-6663, CVE-2016-6664, CVE-2016-7440, CVE-2016-8283, CVE-2016-9843, CVE-2017-10268, CVE-2017-10286, CVE-2017-10320, CVE-2017-10365, CVE-2017-10378, CVE-2017-10379, CVE-2017-10384, CVE-2017-15365, CVE-2017-3238, CVE-2017-3243, CVE-2017-3244, CVE-2017-3257, CVE-2017-3258, CVE-2017-3265, CVE-2017-3291, CVE-2017-3302, CVE-2017-3308, CVE-2017-3309, CVE-2017-3312, CVE-2017-3313, CVE-2017-3317, CVE-2017-3318, CVE-2017-3453, CVE-2017-3456, CVE-2017-3464, CVE-2017-3636, CVE-2017-3641, CVE-2017-3653, CVE-2018-25032, CVE-2018-2562, CVE-2018-2612, CVE-2018-2622, CVE-2018-2640, CVE-2018-2665, CVE-2018-2668, CVE-2018-2755, CVE-2018-2759, CVE-2018-2761, CVE-2018-2766, CVE-2018-2767, CVE-2018-2771, CVE-2018-2777, CVE-2018-2781, CVE-2018-2782, CVE-2018-2784, CVE-2018-2786, CVE-2018-2787, CVE-2018-2810, CVE-2018-2813, CVE-2018-2817, CVE-2018-2819, CVE-2018-3058, CVE-2018-3060, CVE-2018-3063, CVE-2018-3064, CVE-2018-3066, CVE-2018-3143, CVE-2018-3156, CVE-2018-3162, CVE-2018-3173, CVE-2018-3174, CVE-2018-3185, CVE-2018-3200, CVE-2018-3251, CVE-2018-3277, CVE-2018-3282, CVE-2018-3284, CVE-2019-18901, CVE-2019-2510, CVE-2019-2537, CVE-2019-2614, CVE-2019-2627, CVE-2019-2628, CVE-2019-2737, CVE-2019-2739, CVE-2019-2740, CVE-2019-2758, CVE-2019-2805, CVE-2019-2938, CVE-2019-2974, CVE-2020-13249, CVE-2020-14765, CVE-2020-14776, CVE-2020-14789, CVE-2020-14812, CVE-2020-15180, CVE-2020-2574, CVE-2020-2752, CVE-2020-2760, CVE-2020-2812, CVE-2020-2814, CVE-2020-7221, CVE-2021-2154, CVE-2021-2166, CVE-2021-2372, CVE-2021-2389, CVE-2021-27928, CVE-2021-35604, CVE-2021-46657, CVE-2021-46658, CVE-2021-46659, CVE-2021-46661, CVE-2021-46663, CVE-2021-46664, CVE-2021-46665, CVE-2021-46668, CVE-2021-46669, CVE-2022-21427, CVE-2022-21595, CVE-2022-24048, CVE-2022-24050, CVE-2022-24051, CVE-2022-24052, CVE-2022-27376, CVE-2022-27377, CVE-2022-27378, CVE-2022-27379, CVE-2022-27380, CVE-2022-27381, CVE-2022-27382, CVE-2022-27383, CVE-2022-27384, CVE-2022-27386, CVE-2022-27387, CVE-2022-27444, CVE-2022-27445, CVE-2022-27446, CVE-2022-27447, CVE-2022-27448, CVE-2022-27449, CVE-2022-27451, CVE-2022-27452, CVE-2022-27455, CVE-2022-27456, CVE-2022-27457, CVE-2022-27458, CVE-2022-32081, CVE-2022-32083, CVE-2022-32084, CVE-2022-32085, CVE-2022-32086, CVE-2022-32087, CVE-2022-32088, CVE-2022-32089, CVE-2022-32091, CVE-2022-38791, CVE-2022-47015
Jira References: PED-2455, SLE-12253, SLE-8269
Sources used:
SUSE Linux Enterprise Software Development Kit 12 SP5 (src): mariadb-connector-c-3.1.22-2.35.1, lz4-1.8.0-3.5.2, python-mysqlclient-1.3.14-8.9.2, mariadb104-10.4.30-8.5.46
SUSE Linux Enterprise High Performance Computing 12 SP5 (src): mariadb-connector-c-3.1.22-2.35.1, lz4-1.8.0-3.5.2, python-mysqlclient-1.3.14-8.9.2, mariadb104-10.4.30-8.5.46
SUSE Linux Enterprise Server 12 SP5 (src): mariadb-connector-c-3.1.22-2.35.1, lz4-1.8.0-3.5.2, python-mysqlclient-1.3.14-8.9.2, mariadb104-10.4.30-8.5.46
SUSE Linux Enterprise Server for SAP Applications 12 SP5 (src): mariadb-connector-c-3.1.22-2.35.1, lz4-1.8.0-3.5.2, python-mysqlclient-1.3.14-8.9.2, mariadb104-10.4.30-8.5.46

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.