The ssl_verify_server_cert function in sql-common/client.c in MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10; Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier; and Percona Server do not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a "/CN=" string in a field in a certificate, as demonstrated by "/OU=/CN=bar.com/CN=foo.com."
CVSS Details
- CVSS 3.1 Base Score: 5.9
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade mariadb | Aug 30, 2017 | Jan 20, 2016 |
| Amazon_linux | — | Upgrade mysql55Upgrade mysql56 | May 18, 2016 | Jan 27, 2016 |
| Centos_linux | — | Upgrade mariadb-develUpgrade mariadb-benchUpgrade mariadb-libsUpgrade mariadb-serverUpgrade mariadb-embedded-develUpgrade mariadb-testUpgrade mariadbUpgrade mariadb-embedded | Jul 6, 2016 | Jan 27, 2016 |
| Debian | — | Upgrade mariadb-10.0Upgrade mysql-5.5 | Feb 2, 2016 | Jan 27, 2016 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Jul 26, 2016 |
| Freebsd | — | Upgrade mysql55-serverUpgrade percona-serverUpgrade mariadb101-serverUpgrade mysql56-serverUpgrade mysql57-serverUpgrade mariadb100-serverUpgrade percona55-serverUpgrade mariadb55-server | Dec 10, 2025 | Apr 30, 2016 |
| Huawei Euleros 2_0_sp1 | — | Upgrade mariadb-embeddedUpgrade mariadb-develUpgrade mariadbUpgrade mariadb-serverUpgrade mariadb-benchUpgrade mariadb-libsUpgrade mariadb-test | Nov 30, 2017 | Jan 27, 2016 |
| Mariadb Mariadb | — | Upgrade MariaDB to the latest version | Mar 4, 2025 | Jan 27, 2016 |
| Oracle Mysql | — | Upgrade to the latest version of MySQL | Apr 28, 2016 | Jan 27, 2016 |
| Oracle_linux | — | Upgrade mariadb-embedded-develUpgrade mariadbUpgrade mariadb-testUpgrade mariadb-libsUpgrade mariadb-benchUpgrade mariadb-develUpgrade mariadb-embeddedUpgrade mariadb-server | Apr 7, 2016 | Jan 27, 2016 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Nov 30, 2015 |
| Suse | — | Upgrade mariadb-toolsUpgrade mariadb-clientUpgrade libmariadbd-develUpgrade libmysqlclient18Upgrade mariadb-100-errormessagesUpgrade libmysqld19Upgrade mariadb-errormessagesUpgrade libmysqlclient-develUpgrade mysql-toolsUpgrade mysql-clientUpgrade libmysql55client18-x86Upgrade libmariadbd19Upgrade libmysql55client_r18-32bitUpgrade mysqlUpgrade libmysqlclient_r18-32bitUpgrade libmysql55client_r18Upgrade libmysql55client_r18-x86Upgrade libmysql55client18-32bitUpgrade libmysqlclient_r18Upgrade mariadbUpgrade libmysql55client18Upgrade libmysqlclient18-32bitUpgrade libmysqld-develUpgrade libmysqld18 | May 11, 2016 | Jan 27, 2016 |
| Ubuntu | — | Upgrade mysql-server-5.6Upgrade mysql-server-5.5Upgrade mysql-server-5.7 | Apr 21, 2016 | Jan 27, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub