CVE-2020-13249: fedoraproject fedora
CVSS: 8.8v3.1HighModified
AliasesALPINE-CVE-2020-13249SUSE-SU-2020:1423-1SUSE-SU-2020:1431-1UBUNTU-CVE-2020-13249openSUSE-SU-2020:0738-1
Published 20-05-2020Last modified 04-08-2024
Vulnerability summary
CVE-2020-13249 is a high (CVSS 8.8) vulnerability in fedoraproject fedora. EPSS estimates a 2.40% chance of exploitation in the next 30 days, higher than 83.7% of scored vulnerabilities.
CVSS score
8.8/10
010
High · v3.1 (NVD)EPSS score
2.40%
0%100%
Low · -0.54 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 18 · Related 8Timeline
- 20-05-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
libmariadb/mariadb_lib.c in MariaDB Connector/C before 3.1.8 does not properly validate the content of an OK packet received from a server. NOTE: although mariadb_lib.c was originally based on code shipped for MySQL, this issue does not affect any MySQL components supported by Oracle.
CVSS metrics
4 scores · 3 sources · 2 versionsHigh 8.8Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HSourcesAll 3 agree
- OSV · AlpineEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Medium 6.8Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:P/I:P/A:PSourcesSingle source
EPSS trend
Probability
2.40%
Chance of exploitation in the next 30 days
Percentile
84%
Versus all other CVEs
30-day change
-0.54 pp
From 2.94% on 19-09-2026
19-09-202619-10-2026
EPSS score2.40%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Suse10 products
- mariadb-connector-c&distro=SUSE Linux Enterprise High Performance Computing 15-ESPOS< 3.1.8-3.18.1
- mariadb-connector-c&distro=SUSE Linux Enterprise High Performance Computing 15-LTSS< 3.1.8-3.18.1
- mariadb-connector-c&distro=SUSE Linux Enterprise Module for Basesystem 15 SP1< 3.1.8-3.18.1
- mariadb-connector-c&distro=SUSE Linux Enterprise Module for Server Applications 15 SP1< 3.1.8-3.18.1
- mariadb-connector-c&distro=SUSE Linux Enterprise Server 12 SP4< 3.1.8-2.15.1
Ubuntu3 products
- mariadb-10.0All versions (No fix recorded)
- mariadb-10.1< 1:10.1.47-0ubuntu0.18.04.1
- mariadb-10.3< 1:10.3.25-0ubuntu0.20.04.1
Opensuse2 products
- leapEOL15.1
- mariadb-connector-c&distro=openSUSE Leap 15.1< 3.1.8-lp151.3.12.1
Alpine1 product
- mariadb-connector-c< 3.0.10-r1 | < 3.1.6-r1 | < 3.0.8-r1
Fedoraproject1 product
- fedoraEOL31 | 32
Mariadb1 product
- connector\/c< 3.1.8
6 vendors · 18 products
References
15 links- github.com/mariadb-corporation/mariadb-connector-c/commit/2759b87d72926b7c9b5426437a7c8dd15ff57945X Refsource MISCREPORTPatchThird Party Advisory
- github.com/mariadb-corporation/mariadb-connector-c/compare/v3.1.7...v3.1.8X Refsource MISCREPORTRelease NotesThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2020-05/msg00064.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2020-06/msg00054.htmlVendor AdvisoryX Refsource SUSEBroken LinkMailing ListThird Party Advisory
Show all 15 references
- lists.opensuse.org/archives/…Advisory