The ssl_verify_server_cert function in sql-common/client.c in MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10; Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier; and Percona Server do not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a "/CN=" string in a field in a certificate, as demonstrated by "/OU=/CN=bar.com/CN=foo.com."
CVSS Details
- CVSS 3.1 Base Score: 5.9
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade mariadb | Aug 30, 2017 | Jan 20, 2016 |
| Amazon_linux | — | Upgrade mysql56Upgrade mysql55 | May 18, 2016 | Jan 27, 2016 |
| Centos_linux | — | Upgrade mariadb-embedded-develUpgrade mariadb-develUpgrade mariadb-benchUpgrade mariadb-serverUpgrade mariadb-libsUpgrade mariadb-testUpgrade mariadbUpgrade mariadb-embedded | Jul 6, 2016 | Jan 27, 2016 |
| Debian | — | Upgrade mysql-5.5Upgrade mariadb-10.0 | Feb 2, 2016 | Jan 27, 2016 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Jul 26, 2016 |
| Freebsd | — | Upgrade percona55-serverUpgrade percona-serverUpgrade mysql56-serverUpgrade mysql55-serverUpgrade mysql57-serverUpgrade mariadb100-serverUpgrade mariadb101-serverUpgrade mariadb55-server | Dec 10, 2025 | Apr 30, 2016 |
| Huawei Euleros 2_0_sp1 | — | Upgrade mariadb-libsUpgrade mariadb-testUpgrade mariadb-embeddedUpgrade mariadbUpgrade mariadb-serverUpgrade mariadb-benchUpgrade mariadb-devel | Nov 30, 2017 | Jan 27, 2016 |
| Mariadb Mariadb | — | Upgrade MariaDB to the latest version | Mar 4, 2025 | Jan 27, 2016 |
| Oracle Mysql | — | Upgrade to the latest version of MySQL | Apr 28, 2016 | Jan 27, 2016 |
| Oracle_linux | — | Upgrade mariadbUpgrade mariadb-embedded-develUpgrade mariadb-testUpgrade mariadb-develUpgrade mariadb-libsUpgrade mariadb-benchUpgrade mariadb-serverUpgrade mariadb-embedded | Apr 7, 2016 | Jan 27, 2016 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Nov 30, 2015 |
| Suse | — | Upgrade libmysqlclient_r18Upgrade libmysqld-develUpgrade libmysql55client18Upgrade libmysqld18Upgrade mariadbUpgrade libmysql55client_r18-x86Upgrade libmysqlclient18-32bitUpgrade libmysql55client_r18Upgrade libmysql55client18-32bitUpgrade libmysql55client18-x86Upgrade libmysqld19Upgrade mysqlUpgrade libmysql55client_r18-32bitUpgrade mariadb-errormessagesUpgrade libmysqlclient-develUpgrade libmysqlclient18Upgrade libmariadbd-develUpgrade mariadb-toolsUpgrade mysql-clientUpgrade libmysqlclient_r18-32bitUpgrade mariadb-clientUpgrade mariadb-100-errormessagesUpgrade libmariadbd19Upgrade mysql-tools | May 11, 2016 | Jan 27, 2016 |
| Ubuntu | — | Upgrade mysql-server-5.7Upgrade mysql-server-5.5Upgrade mysql-server-5.6 | Apr 21, 2016 | Jan 27, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub