Improper Certificate Validation Affecting mariadb-bench package, versions <1:5.5.47-1.el7_2


Severity

Recommended
0.0
medium
0
10

Based on Red Hat Enterprise Linux security rating.

Threat Intelligence

EPSS
0.46% (77th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL7-MARIADBBENCH-4612544
  • published26 Jul 2021
  • disclosed30 Nov 2015

Introduced: 30 Nov 2015

CVE-2016-2047  (opens in a new tab)
CWE-295  (opens in a new tab)

How to fix?

Upgrade RHEL:7 mariadb-bench to version 1:5.5.47-1.el7_2 or higher.
This issue was patched in RHSA-2016:0534.

NVD Description

Note: Versions mentioned in the description apply only to the upstream mariadb-bench package and not the mariadb-bench package as distributed by RHEL. See How to fix? for RHEL:7 relevant fixed versions and status.

The ssl_verify_server_cert function in sql-common/client.c in MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10; Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier; and Percona Server do not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a "/CN=" string in a field in a certificate, as demonstrated by "/OU=/CN=bar.com/CN=foo.com."

CVSS Scores

version 3.1