Bug 24624 - mariadb 10.1.38
Summary: mariadb 10.1.38
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 6
Hardware: All Linux
Priority: Normal major
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA6-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2019-04-05 21:56 CEST by David Walser
Modified: 2019-04-11 00:08 CEST (History)
5 users (show)

See Also:
Source RPM: mariadb-10.1.37-1.mga6.src.rpm
CVE:
Status comment:


Attachments

Description David Walser 2019-04-05 21:56:45 CEST
MariaDB 10.1.38 was released on February 6, fixing two security issues:
https://mariadb.com/kb/en/library/mariadb-10138-release-notes/

The security issues were listed in the January Oracle CPU:
https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
Comment 1 Marc Krämer 2019-04-05 23:29:31 CEST
sorry, I've seen this release, but it didn't look very severe to me.
Comment 2 David Walser 2019-04-05 23:45:45 CEST
We should always keep mariadb up to date.  The release notes are often missing security info at first.
Comment 3 Marc Krämer 2019-04-05 23:46:48 CEST
ok, I'll take care of it. mariadb is just building.
Comment 4 David Walser 2019-04-07 01:18:56 CEST
Advisory:
========================

Updated mariadb packages fix security vulnerabilities:

Vulnerability in the MariaDB Server component of MariaDB (subcomponent: Server:
Optimizer). Easily exploitable vulnerability allows low privileged attacker
with network access via multiple protocols to compromise MariaDB Server.
Successful attacks of this vulnerability can result in unauthorized ability to
cause a hang or frequently repeatable crash (complete DOS) of MariaDB Server
(CVE-2019-2529).

Vulnerability in the MariaDB Server component of MariaDB (subcomponent: Server:
DDL). Easily exploitable vulnerability allows high privileged attacker with
network access via multiple protocols to compromise MariaDB Server. Successful
attacks of this vulnerability can result in unauthorized ability to cause a
hang or frequently repeatable crash (complete DOS) of MariaDB Server
(CVE-2019-2537).

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-2529
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-2537
https://mariadb.com/kb/en/library/mariadb-10138-release-notes/
https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
========================

Updated packages in core/updates_testing:
========================
mariadb-10.1.38-1.mga6
mysql-MariaDB-10.1.38-1.mga6
mariadb-cassandra-10.1.38-1.mga6
mariadb-feedback-10.1.38-1.mga6
mariadb-connect-10.1.38-1.mga6
mariadb-sphinx-10.1.38-1.mga6
mariadb-mroonga-10.1.38-1.mga6
mariadb-sequence-10.1.38-1.mga6
mariadb-spider-10.1.38-1.mga6
mariadb-extra-10.1.38-1.mga6
mariadb-obsolete-10.1.38-1.mga6
mariadb-core-10.1.38-1.mga6
mariadb-common-core-10.1.38-1.mga6
mariadb-common-10.1.38-1.mga6
mariadb-client-10.1.38-1.mga6
mariadb-bench-10.1.38-1.mga6
libmariadb18-10.1.38-1.mga6
libmariadb-devel-10.1.38-1.mga6
libmariadb-embedded18-10.1.38-1.mga6
libmariadb-embedded-devel-10.1.38-1.mga6

from mariadb-10.1.38-1.mga6.src.rpm

Assignee: mageia => qa-bugs
Severity: normal => major
CC: (none) => mageia

Comment 5 Marc Krämer 2019-04-07 02:29:16 CEST
@David: thanks for the advisory, I was busy this afternoon.
Comment 6 Brian Rockwell 2019-04-08 02:56:17 CEST
$ uname -a
Linux linux.local 4.14.104-desktop-2.mga6 #1 SMP Wed Feb 27 17:08:11 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux


The following 36 packages are going to be installed:

- lib64aio-devel-0.3.110-4.mga6.x86_64
- lib64jemalloc2-4.5.0-4.mga6.x86_64
- lib64lz4-devel-1.7.5-1.mga6.x86_64
- lib64lzo-devel-2.09-4.mga6.x86_64
- lib64mariadb-devel-10.1.38-1.mga6.x86_64
- lib64mariadb-embedded-devel-10.1.38-1.mga6.x86_64
- lib64mariadb-embedded18-10.1.38-1.mga6.x86_64
- lib64mariadb18-10.1.38-1.mga6.x86_64
- lib64minilzo0-2.09-4.mga6.x86_64
- lib64openssl-devel-1.0.2r-1.mga6.x86_64
- lib64pcre-devel-8.41-1.mga6.x86_64
- lib64pcre16_0-8.41-1.mga6.x86_64
- lib64pcre32_0-8.41-1.mga6.x86_64
- lib64pcreposix1-8.41-1.mga6.x86_64
- lib64pq5-9.6.10-3.mga6.x86_64
- lib64thrift0-0.9.3-6.mga6.x86_64
- mariadb-10.1.38-1.mga6.x86_64
- mariadb-bench-10.1.38-1.mga6.x86_64
- mariadb-cassandra-10.1.38-1.mga6.x86_64
- mariadb-client-10.1.38-1.mga6.x86_64
- mariadb-common-10.1.38-1.mga6.x86_64
- mariadb-common-core-10.1.38-1.mga6.x86_64
- mariadb-connect-10.1.38-1.mga6.x86_64
- mariadb-core-10.1.38-1.mga6.x86_64
- mariadb-extra-10.1.38-1.mga6.x86_64
- mariadb-feedback-10.1.38-1.mga6.x86_64
- mariadb-mroonga-10.1.38-1.mga6.x86_64
- mariadb-obsolete-10.1.38-1.mga6.x86_64
- mariadb-sequence-10.1.38-1.mga6.x86_64
- mariadb-sphinx-10.1.38-1.mga6.x86_64
- mariadb-spider-10.1.38-1.mga6.x86_64
- mysql-MariaDB-10.1.38-1.mga6.x86_64
- perl-DBD-mysql-4.46.0-1.mga6.x86_64
- perl-DBI-1.636.0-2.mga6.x86_64
- perl-GD-2.560.0-4.mga6.x86_64
- sphinx-2.2.11-1.mga6.x86_64

use the mysql interface.  Created a database, a table. Inserted rows and deleted rows.

Working as designed.

Whiteboard: (none) => MGA6-64-OK
CC: (none) => brtians1

Comment 7 PC LX 2019-04-09 12:50:03 CEST
Installed and tested without issues.

System: Mageia 6, x86_64, Intel CPU.

Tests included using:
- MySQL workbench;
- mysql CLI client with several large SQL scripts;
- Several PHP scripts that use PDO/MySQL;
- Several Qt5 C++ applications that use Qt5 MySQL plugin;

$ uname -a
Linux marte 4.14.106-desktop-1.mga6 #1 SMP Thu Mar 14 18:01:29 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux
$ rpm -qa | grep mariadb | sort
lib64mariadb18-10.1.38-1.mga6
lib64mariadb-embedded18-10.1.38-1.mga6
mariadb-10.1.38-1.mga6
mariadb-bench-10.1.38-1.mga6
mariadb-client-10.1.38-1.mga6
mariadb-common-10.1.38-1.mga6
mariadb-common-core-10.1.38-1.mga6
mariadb-core-10.1.38-1.mga6
mariadb-extra-10.1.38-1.mga6
mariadb-feedback-10.1.38-1.mga6
$ rpm -qa | grep mysql | sort
lib64mysqlcppconn7-1.1.8-1.mga6
lib64qt5-database-plugin-mysql-5.9.4-1.2.mga6
mysql-workbench-6.3.9-1.mga6
perl-DBD-mysql-4.46.0-1.mga6
php-mysqli-7.2.14-1.mga6
php-mysqlnd-7.2.14-1.mga6
php-pdo_mysql-7.2.14-1.mga6
php-pear-MDB2_Driver_mysql-1.5.0-0.0.b10.mga6
php-pear-MDB2_Driver_mysqli-1.5.0-0.0.b9.mga6

CC: (none) => mageia

Comment 8 Dave Hodgins 2019-04-10 23:24:20 CEST
Advisory committed to svn. Validating based on comment 7.

Keywords: (none) => advisory, validated_update
CC: (none) => davidwhodgins, sysadmin-bugs

Comment 9 Mageia Robot 2019-04-11 00:08:30 CEST
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2019-0147.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED


Note You need to log in before you can comment on or make changes to this bug.