Assigning to the Perl stack maintainers, CC'ing the registered maintainer.

Assignee: bugsquad => perl
CC: (none) => marja11, shlomif

Updated packages uploaded by Shlomi and myself.  Thanks Shlomi!

Advisory:
========================

Updated perl-DBD-mysql package fixes security vulnerabilities:

The DBD::mysql Perl module through 4.043 for Perl allows remote attackers to
cause a denial of service (use-after-free and application crash) or possibly
have unspecified other impact by triggering certain error responses from a
MySQL server or a loss of a network connection to a MySQL server. The
use-after-free defect was introduced by relying on incorrect Oracle
mysql_stmt_close documentation and code examples (CVE-2017-10788).

The DBD::mysql Perl module, when used with mysql_ssl=1 setting enabled, means
that SSL is optional (even though this setting's documentation has a "your communication with the server will be encrypted" statement), which could lead
man-in-the-middle attackers to spoof servers via a cleartext-downgrade attack
(CVE-2017-10789).

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10788
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10789
https://lists.opensuse.org/opensuse-updates/2018-05/msg00138.html
========================

Updated packages in core/updates_testing:
========================
perl-DBD-mysql-4.46.0-1.mga5
perl-DBD-mysql-4.46.0-1.mga6

from SRPMS:
perl-DBD-mysql-4.46.0-1.mga5.src.rpm
perl-DBD-mysql-4.46.0-1.mga6.src.rpm

Assignee: perl => qa-bugs
Whiteboard: (none) => MGA5TOO

MGA5-32 on Dell Latitude D600 Xfce
No installation issues.
Googling fiddled a test script (see attachment)
$ perl perldbdtest.pl 
DBD::mysql::db do failed: Unknown table 'test10.0.35.foo' at perldbdtest.pl line 14.
Dropping foo failed: DBD::mysql::db do failed: Unknown table 'test10.0.35.foo' at perldbdtest.pl line 14.

Found a row: id = 1, name = Tim
Found a row: id = 2, name = Jochen
Looks OK to me.

CC: (none) => herman.viaene
Whiteboard: MGA5TOO => MGA5TOO MGA5-32-OK

Created attachment 10235 [details]
test script perl-mysql

MGA6-32 on Thinkpad R50e MATE
No installation issues.
Used same testscript as above
$ perl perldbdtest.pl 
DBD::mysql::db do failed: Unknown table 'test.foo' at perldbdtest.pl line 14.
Dropping foo failed: DBD::mysql::db do failed: Unknown table 'test.foo' at perldbdtest.pl line 14.

Found a row: id = 1, name = Tim
Found a row: id = 2, name = Jochen
OK for me.

Whiteboard: MGA5TOO MGA5-32-OK => MGA5TOO MGA5-32-OK MGA6-32-OK

Nice test Herman. Validating.

Keywords: (none) => has_procedure, validated_update
CC: (none) => sysadmin-bugs

Advisoried.

Keywords: (none) => advisory

An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2018-0283.html

Resolution: (none) => FIXED
Status: NEW => RESOLVED