Oracle MySQL before 5.7.3, Oracle MySQL Connector/C (aka libmysqlclient) before 6.1.3, and MariaDB before 5.5.44 use the --ssl option to mean that SSL is optional, which allows man-in-the-middle attackers to spoof servers via a cleartext-downgrade attack, aka a "BACKRONYM" attack.
CVSS Details
- CVSS 3.1 Base Score: 5.9
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | alpine-linux-upgrade-mariadb | Sep 20, 2017 | May 16, 2016 |
| Centos_linux | — | centos-upgrade-mariadbcentos-upgrade-mariadb-benchcentos-upgrade-mariadb-develcentos-upgrade-mariadb-embeddedcentos-upgrade-mariadb-embedded-develcentos-upgrade-mariadb-libscentos-upgrade-mariadb-servercentos-upgrade-mariadb-test | Dec 1, 2016 | May 16, 2016 |
| Mariadb Mariadb | mariadb-mariadb-upgrade-latest | Mar 4, 2025 | May 16, 2016 | |
| Oracle Mysql | mysql-upgrade-5_7_3mysql-upgrade-6_1_3 | May 19, 2016 | May 16, 2016 | |
| Oracle Solaris | oracle-solaris-11-4-upgrade-library-perl-5-dbd-mysql-4048-11-4-3-0-1-4-0oracle-solaris-11-4-upgrade-library-perl-5-dbd-mysql-522-4048-11-4-3-0-1-4-0oracle-solaris-11-4-upgrade-library-perl-5-dbd-mysql-526-4048-11-4-3-0-1-4-0 | Nov 19, 2018 | May 16, 2016 | |
| Oracle_linux | — | oracle-linux-upgrade-mariadboracle-linux-upgrade-mariadb-benchoracle-linux-upgrade-mariadb-develoracle-linux-upgrade-mariadb-embeddedoracle-linux-upgrade-mariadb-embedded-develoracle-linux-upgrade-mariadb-libsoracle-linux-upgrade-mariadb-serveroracle-linux-upgrade-mariadb-test | Oct 16, 2024 | May 16, 2016 |
| Php | php-upgrade-5_4_43php-upgrade-5_5_27php-upgrade-5_6_11 | Sep 15, 2022 | May 16, 2016 | |
| Ubuntu | ubuntu-upgrade-mariadb-10-0ubuntu-upgrade-mariadb-5-5 | Nov 19, 2024 | May 16, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub