The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
xbcrypt in Percona XtraBackup before 2.3.6 and 2.4.x before 2.4.5 does not properly set the initialization vector (IV) for encryption, which makes it easier for context-dependent attackers to obtain sensitive information from encrypted backup files via a Chosen-Plaintext attack. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-6394.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Suse | — | Upgrade xtrabackupUpgrade xtrabackup-testUpgrade xtrabackup-debugsourceUpgrade xtrabackup-debuginfo | Jan 24, 2017 | Jan 23, 2017 |
| Ubuntu | — | Upgrade percona-xtrabackup | Nov 19, 2024 | Mar 23, 2017 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub