p PatchFirst

CVE-2016-2047

CVE-2016-2047

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

The ssl_verify_server_cert function in sql-common/client.c in MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10; Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier; and Percona Server do not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a "/CN=" string in a field in a certificate, as demonstrated by "/OU=/CN=bar.com/CN=foo.com."

CVSS 5.9 · Medium · EPSS 3.7% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • mariadb-5.5 Ubuntu:14.04:LTS

    Versions
    • 5.5.32-1ubuntu1
    • 5.5.35-1ubuntu1
    • 5.5.36-1
    • 5.5.37-0ubuntu0.14.04.1
    • 5.5.39-0ubuntu0.14.04.1
    • 5.5.40-0ubuntu0.14.04.1
    • 5.5.41-0ubuntu0.14.04.2
    • 5.5.41-1ubuntu0.14.04.1
    • 5.5.43-1ubuntu0.14.04.2
    • 5.5.44-1ubuntu0.14.04.1
    • 5.5.46-1ubuntu0.14.04.2
    Affected ranges
    • ECOSYSTEM: < 5.5.47-1ubuntu0.14.04.1

    Update to 5.5.47-1ubuntu0.14.04.1

  • mysql-5.5 Ubuntu:14.04:LTS

    Versions
    • 5.5.32-0ubuntu7
    • 5.5.34-0ubuntu1
    • 5.5.34-0ubuntu2
    • 5.5.35-0ubuntu1
    • 5.5.35+dfsg-1ubuntu1
    • 5.5.37-0ubuntu0.14.04.1
    • 5.5.38-0ubuntu0.14.04.1
    • 5.5.40-0ubuntu0.14.04.1
    • 5.5.41-0ubuntu0.14.04.1
    • 5.5.43-0ubuntu0.14.04.1
    • 5.5.44-0ubuntu0.14.04.1
    • 5.5.46-0ubuntu0.14.04.2
    • 5.5.47-0ubuntu0.14.04.1
    Affected ranges
    • ECOSYSTEM: < 5.5.49-0ubuntu0.14.04.1

    Update to 5.5.49-0ubuntu0.14.04.1

  • mysql-5.6 Ubuntu:14.04:LTS

    Versions
    • 5.6.15-0ubuntu1
    • 5.6.15-1~exp2
    • 5.6.16-1~exp1
    • 5.6.17-0ubuntu0.14.04.1
    • 5.6.19-0ubuntu0.14.04.1
    • 5.6.27-0ubuntu0.14.04.1
    • 5.6.28-0ubuntu0.14.04.1
    Affected ranges
    • ECOSYSTEM: < 5.6.30-0ubuntu0.14.04.1

    Update to 5.6.30-0ubuntu0.14.04.1

  • mysql-5.7 Ubuntu:16.04:LTS

    Versions
    • 5.7.11-0ubuntu4
    • 5.7.11-0ubuntu5
    • 5.7.11-0ubuntu6
    Affected ranges
    • ECOSYSTEM: < 5.7.12-0ubuntu1

    Update to 5.7.12-0ubuntu1

  • percona-xtradb-cluster-5.6 Ubuntu:16.04:LTS

    Versions
    • 5.6.21-25.8-0ubuntu2
    • 5.6.21-25.8-0ubuntu3
    • 5.6.21-25.8-0ubuntu3.1
    • 5.6.21-25.8-0ubuntu3.2
    Affected ranges
    • ECOSYSTEM: < 5.6.34-26.19-0ubuntu0.16.04.1

    Update to 5.6.34-26.19-0ubuntu0.16.04.1

  • percona-server-5.6 Ubuntu:16.04:LTS

    Versions
    • 5.6.22-rel71.0-0ubuntu2
    • 5.6.22-rel71.0-0ubuntu4
    • 5.6.22-rel71.0-0ubuntu4.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →