CVE-2020-15180: debian debian_linux Improper Input Validation
Vulnerability summary
CVE-2020-15180 is a critical (CVSS 9.0) Improper Input Validation vulnerability in debian debian_linux. EPSS estimates a 5.54% chance of exploitation in the next 30 days, higher than 92.7% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 16 · Related 11Timeline
- 27-05-2021PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
A flaw was found in the mysql-wsrep component of mariadb. Lack of input sanitization in `wsrep_sst_method` allows for command injection that can be exploited by a remote attacker to execute arbitrary commands on galera cluster nodes. This threatens the system's confidentiality, integrity, and availability. This flaw affects mariadb versions before 10.1.47, before 10.2.34, before 10.3.25, before 10.4.15 and before 10.5.6.
CVSS metrics
6 scores · 5 sources · 2 versions- OSV · AlpineEcosystem advisory · calculated9.0CriticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
- OSV · Red hatEcosystem advisory · calculated9.0CriticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated9.0CriticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.0CriticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS trend
Probability
5.54%
Chance of exploitation in the next 30 days
Percentile
93%
Versus all other CVEs
30-day change
0.00 pp
From 5.54% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- CWE-77Improper Neutralization of Special Elements used in a Command ('Command Injection')The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Affected systems
Debian4 products
- mariadb-10.1< 10.1.47-0+deb9u1
- mariadb-10.3< 1:10.3.25-0+deb10u1
- mariadb-10.5< 1:10.5.6-1
- debian_linuxEOL9.0 | 10.0
Redhat4 products
- mariadb-galera< 1:5.5.62-2.el7ost
- mariadb-galera-common< 1:5.5.62-2.el7ost
- mariadb-galera-debuginfo< 1:5.5.62-2.el7ost
- mariadb-galera-server< 1:5.5.62-2.el7ost
Ubuntu3 products
- mariadb-10.0All versions (No fix recorded)
- mariadb-10.1< 1:10.1.47-0ubuntu0.18.04.1
- mariadb-10.3< 1:10.3.25-0ubuntu0.20.04.1
Alpine1 product
- mariadb≥ 10.1.0, < 10.3.25-r0 | ≥ 10.1.0, < 10.4.15-r0 | ≥ 10.1.0, < 10.5.6-r0
Galeracluster1 product
- galera_cluster_for_mysql≥ 5.6, < 5.6.49 | ≥ 5.7, < 5.7.31 | ≥ 8.0, < 8.0.21
Mageia1 product
- mariadb< 10.3.25-1.mga7
Mariadb1 product
- mariadb≥ 10.1.0, < 10.1.47 | ≥ 10.2.0, < 10.2.34 | ≥ 10.3.0, < 10.3.25 | ≥ 10.4.0, < 10.4.15 | ≥ 10.5.0, < 10.5.6
Percona1 product
- xtradb_cluster< 5.6.49-28.42.2 | ≥ 5.7, < 5.7.31-31.45.2 | ≥ 8.0, < 8.0.20-11.2
8 vendors · 16 products
References
19 links
lists.debian.org/debian-lts-announce/2020/10/msg00021.htmlMailing ListX Refsource MLISTThird Party Advisory- www.percona.com/blog/2020/10/30/cve-2020-15180-affects-percona-xtradb-cluster/X Refsource CONFIRMPatchThird Party Advisory
