Oval Definition:oval:org.opensuse.security:def:60674
Revision Date:2020-12-01Version:1
Title:Security update for galera-3, mariadb, mariadb-connector-c (Important)
Description:
This update for mariadb, galera-3, mariadb-connector fixes the following issues:

Security vulnerabilities addressed for mariadb:

- CVE-2016-9843 [bsc#1013882]
- CVE-2018-3058 [bsc#1101676]
- CVE-2018-3060
- CVE-2018-3063 [bsc#1101677]
- CVE-2018-3064 [bsc#1103342]
- CVE-2018-3066 [bsc#1101678]
- CVE-2018-3143 [bsc#1112421]
- CVE-2018-3156 [bsc#1112417]
- CVE-2018-3162 [bsc#1112415]
- CVE-2018-3173 [bsc#1112386]
- CVE-2018-3174 [bsc#1112368]
- CVE-2018-3185 [bsc#1112384]
- CVE-2018-3200 [bsc#1112404]
- CVE-2018-3251 [bsc#1112397]
- CVE-2018-3277 [bsc#1112391]
- CVE-2018-3282 [bsc#1112432]
- CVE-2018-3284 [bsc#1112377]

Other bug fixes and changes for mariadb:

- update to 10.2.21 GA
* MDEV-17589 - Stack-buffer-overflow with indexed varchar
(utf8) field
* MDEV-16987 - ALTER DATABASE possible in read-only mode
(forbid ALTER DATABASE in read_only)
* MDEV-17720 - slave_ddl_exec_mode=IDEMPOTENT does not handle
DROP DATABASE
* MDEV-6453 - Assertion `inited==NONE || (inited==RND && scan)'
failed in handler::ha_rnd_init(bool) with InnoDB, joins,
AND/OR conditions
* MDEV-18105 - Mariabackup fails to copy encrypted InnoDB
system tablespace if LSN>4G
* MDEV-18041 - Database corruption after renaming a
prefix-indexed column [bsc#1120041]
* MDEV-17470 - Orphan temporary files after interrupted ALTER
cause InnoDB: Operating system error number 17 and eventual
fatal error 71
* MDEV-17833: ALTER TABLE is not enforcing prefix index size
limit
* MDEV-17989: InnoDB: Failing assertion:
dict_tf2_is_valid(flags, flags2)
* MDEV-17765: Locking bug fix for SPATIAL INDEX
* MDEV-17923, MDEV-17904, MDEV-17938: Fixes for FULLTEXT INDEX
* Fixes for regressions introduced in MariaDB Server 10.2.19 by
the backup-safe TRUNCATE TABLE (MDEV-13564,
innodb_safe_truncate=ON) and innodb_undo_log_truncate:
* MDEV-17780, MDEV-17816, MDEV-17849, MDEV-17851, MDEV-17885
* Several improvements to MariaDB Server and backup for dealing
with encrypted or page_compressed pages:
* MDEV-12112: corruption in encrypted table may be overlooked
* MDEV-17958: On little-endian systems, remove bug-compatible
variant of innodb_checksum_algorithm=crc32
* MDEV-17957: Make innodb_checksum_algorithm stricter for
strict_* values
* MDEV-18025: Mariabackup fails to detect corrupted
page_compressed=1 tables
* release notes and changelog:
- https://mariadb.com/kb/en/library/mariadb-10221-release-notes
- https://mariadb.com/kb/en/library/mariadb-10221-changelog
- https://mariadb.com/kb/en/library/mariadb-10220-release-notes
- https://mariadb.com/kb/en/library/mariadb-10220-changelog
- remove PerconaFT from the package as it has AGPL licence (bsc#1118754)
- Add patch to link against libatomic where necessary and
use C++11 atomics instead of gcc built-in atomics
- update to 10.2.19 GA [bsc#1116686]
* innodb_safe_truncate system variable for a backup-safe
TRUNCATE TABLE implementation that is based on RENAME,
CREATE, DROP (MDEV-14717, MDEV-14585, MDEV-13564). Default
value for this variable is ON. If you absolutely must use
XtraBackup instead of Mariabackup, you can set it to OFF and
restart the server
* MDEV-17289: Multi-pass recovery fails to apply some redo
log records
* MDEV-17073: INSERT…ON DUPLICATE KEY UPDATE became more
deadlock-prone
* MDEV-17491: micro optimize page_id_t
* MDEV-13671: InnoDB should use case-insensitive column name
comparisons like the rest of the server
* Fixes for indexed virtual columns: MDEV-17215, MDEV-16980
* MDEV-17433: Allow InnoDB start up with empty ib_logfile0
from mariabackup --prepare
* MDEV-12547: InnoDB FULLTEXT index has too strict
innodb_ft_result_cache_limit max limit
* MDEV-17541: KILL QUERY during lock wait in FOREIGN KEY
check causes hang
* MDEV-17531: Crash in RENAME TABLE with FOREIGN KEY and
FULLTEXT INDEX
* MDEV-17532: Performance_schema reports wrong directory for
the temporary files of ALTER TABLE…ALGORITHM=INPLACE
* MDEV-17545: Predicate lock for SPATIAL INDEX should lock
non-matching record
* MDEV-17546: SPATIAL INDEX should not be allowed for
FOREIGN KEY
* MDEV-17548: Incorrect access to off-page column for
indexed virtual column
* MDEV-12023: Assertion failure sym_node->table != NULL
on startup
* MDEV-17230: encryption_key_id from alter is ignored by
encryption threads
* release notes and changelog:
- https://mariadb.com/kb/en/library/mariadb-10219-release-notes
- https://mariadb.com/kb/en/library/mariadb-10219-changelog
- do not pack libmariadb.pc (packed in mariadb-connector-c)
- add 'Requires: libmariadb_plugins' to the mariadb-test subpackage
in order to be able to test client plugins successfuly
(bsc#1111859)
- don't remove debug_key_management.so anymore (bsc#1111858)
- update to 10.2.18 GA
* MDEV-15511 - if available, stunnel can be used during Galera
rsync SST
* MDEV-16791 - mariabackup: Support DDL commands during backup
* MDEV-13564 - Refuse MLOG_TRUNCATE in mariabackup
* MDEV-16934 - add new system variable eq_range_index_dive_limit
to speed up queries that new long nested IN lists. The default
value, for backward compatibility, is 0 meaning 'unlimited'.
* MDEV-13333 - errors on InnoDB lock conflict
* Report all InnoDB redo log corruption
* MDEV-17043 - Purge of indexed virtual columns may cause hang
on table-rebuilding DDL
* MDEV-16868 - corruption of InnoDB temporary tables
* MDEV-16465 - Invalid (old?) table or database name or hang
in ha_innobase::delete_table and log semaphore wait upon
concurrent DDL with foreign keys
* release notes and changelog:
- https://mariadb.com/kb/en/library/mariadb-10218-release-notes
- https://mariadb.com/kb/en/library/mariadb-10218-changelog
- update to 10.2.17 GA
* New variable innodb_log_optimize_ddl for avoiding delay due
to page flushing and allowing concurrent backup
* InnoDB updated to 5.7.23
* MDEV-14637 - Fix hang due to DDL with FOREIGN KEY or
persistent statistics
* MDEV-15953 - Alter InnoDB Partitioned Table Moves Files
(which were originally not in the datadir) to the datadir
* MDEV-16515 - InnoDB: Failing assertion: ++retries < 10000 in
file dict0dict.cc line 2737
* MDEV-16809 - Allow full redo logging for ALTER TABLE
* Temporary tables: MDEV-16713 - InnoDB hang with repeating
log entry
* indexed virtual columns: MDEV-15855 - Deadlock between purge
thread and DDL statement
* MDEV-16664 - Change the default to
innodb_lock_schedule_algorithm=fcfs
* Galera: MDEV-15822 - WSREP: BF lock wait long for trx
* release notes and changelog:
- https://mariadb.com/kb/en/library/mariadb-10217-release-notes
- https://mariadb.com/kb/en/library/mariadb-10217-changelog
- switch to libedit as control sequences were already fixed there
so we don't have to avoid it (bsc#1098683)
- update to 10.2.16 GA
* MDEV-13122: mariabackup now supports MyRocks
* MDEV-13779 - InnoDB fails to shut down purge workers, causing
hang
* MDEV-16267 - Wrong INFORMATION_SCHEMA.INNODB_BUFFER_PAGE.\
TABLE_NAME
* MDEV-13834 - Upgrade failure from 10.1 innodb_encrypt_log
* MDEV-16283 - ALTER TABLE...DISCARD TABLESPACE still takes long
on a large buffer pool
* MDEV-16376 - ASAN: heap-use-after-free in
gcol.innodb_virtual_debug
* MDEV-15824 - innodb_defragment=ON trumps
innodb_optimize_fulltext_only=ON in OPTIMIZE TABLE
* MDEV-16124 - fil_rename_tablespace() times out and crashes
server during table-rebuilding ALTER TABLE
* MDEV-16416 - Crash on IMPORT TABLESPACE of a
ROW_FORMAT=COMPRESSED table
* MDEV-16456 - InnoDB error 'returned OS error 71' complains
about wrong path
* MDEV-13103 - Deal with page_compressed page corruption
* MDEV-16496 - Mariabackup: Implement --verbose option to
instrument InnoDB log apply
* MDEV-16087 - Inconsistent SELECT results when query cache
is enabled
* MDEV-15114 - ASAN heap-use-after-free in mem_heap_dup or
dfield_data_is_binary_equal (fix for indexed virtual columns)
* release notes and changelog:
- https://mariadb.com/kb/en/library/mariadb-10216-release-notes
- https://mariadb.com/kb/en/library/mariadb-10216-changelog
- pack wsrep_sst_rsync_wan file to galera subpackage

Bug fixes and changes for galera-3:

- update to 25.3.24:
* A support for new certification key type was added to allow
more relaxed certification rules for foreign key references (galera#491).
* New status variables were added to display the number of open transactions
and referenced client connections inside Galera provider (galera#492).
* GCache was sometimes cleared unnecessarily on startup if the recovered
state had smaller sequence number than the highest found from GCache.
Now only entries with sequence number higher than recovery point will be
cleared (galera#498).
* Non-primary configuration is saved into grastate.dat only when if the
node is in closing state (galera#499).
* Exception from GComm was not always handled properly resulting in
Galera to remain in half closed state. This was fixed by propagating the
error condition appropriately to upper layers (galera#500).
* A new status variable displaying the total weight of the cluster nodes
was added (galera#501).
* The value of pc.weight did not reflect the actual effective value after
setting it via wsrep_provider_options. This was fixed by making sure that
the new value is taken into use before returning the control back to
caller (galera#505, MDEV-11959)
* Use of ECHD algorithms with old OpenSSL versions was enabled (galera#511).
* Default port value is now used by garbd if the port is not explicitly
given in cluster address (MDEV-15531).
* Correct error handling for posix_fallocate().
* Failed causal reads are retried during configuration changes.

Bug fixes and changes for mariadb-connector-c:

- New upstream version 3.0.6
* MDEV-15263: FIx IS_NUM() macro
* CONC-297: local infile parameter must be unsigned int instead
of my_bool
* CONC-329: change return value of internal socket functions
from my_bool to int
* CONC-332: my_auth doesn't read/update server ok packet
* CONC-344: reset internal row counter
* CONC-345: invalid heap use after free
* CONC-346: Remove old cmake policies
* fixed crash in mysql_select_db if NULL parameter was provided
- New upstream version 3.0.5
* CONC-336: Allow multiple initialization of client library
* Fixed string to MYSQL_TIME conversion (prepared statements)
* CONC-334: Copy all members of MYSQL_FIELD to internal
statement structure
* Fixed double free in dynamic column library
* Added checks for corrupted packets in protocol
* MDEV-15450: Added default connection attribute _server_host
* CONC-326: fixed wrong openssl thread id callback
- New upstream version 3.0.4
* Added option MYSQL_OPT_CAN_HANDLE_EXPIRED_PASSWORDS for
mysql_options()/mysql_optionsv():
* New plugin configuration interface: The default configuration
for a specific plugin can be specified via cmake parameter
-DCLIENT_PLUGIN_${PLUGIN}=[DYNAMIC|STATIC|OFF].
* Added support for linux abstract socket (MDEV-15655).
* CONC-320: Added asynchronous/non-blocking support for
OpenSSL and GnuTLS
* CONC-294: Access violation in mysql_close when using
a connection plugin.
* MDEV-14977: If built dynamically the old_password plugin
could not be located due to wrong filename (must be
mysql_old_password.so instead of old_password.so).
* CONC-315: If no default client character set was specified,
the utf8 character set will be used by default (instead of
setting the client character set to server character set)
* CONC-317: Parsing of configuration file fails if key/value
pairs contain white spaces.
* CONC-322: Correct handling of EAGAIN and EINPROGRESS in
internal_connect (socket) for non windows platforms.
* CONC-323: mariadb_stmt_execute_direct hangs forever if
compression used.
* CONC-324: Wrong codepage numbers for some collations.
* CONC-326: ssl_thread_init() uses wrong openssl threadid
callback
- Drop libmysqlclient_r Provides from the -devel package.
(bsc#1097938)
Family:unixClass:patch
Status:Reference(s):1013882
1047236
1047240
1056134
1067720
1069666
1081741
1083507
1084191
1086001
1087813
1088004
1088009
1093697
1095472
1097938
1098683
1101676
1101677
1101678
1102379
1102400
1102410
1103342
1107030
1111858
1111859
1112368
1112377
1112384
1112386
1112391
1112397
1112404
1112415
1112417
1112421
1112432
1116686
1118754
1120041
1120386
1129180
1131863
1132665
1133147
1134156
1137325
1139073
1140359
1141035
1145604
1145929
1146882
1146884
1149591
1151021
1154043
1154118
1154844
1155689
1155988
1157155
1157157
1157303
1157804
1158021
1158642
1158819
1159199
1159285
1159297
1159841
1159908
1159910
1159911
1159912
1160195
1161586
1162227
1162928
1162929
1162931
1163508
1163971
1164009
1164051
1164069
1164078
1164846
1165111
1165311
1165873
1165881
1165984
1165985
1166238
1167421
1167423
1167629
1168075
1168295
1168424
1168829
1168854
1169511
1170056
1170345
1170778
1170847
1171252
1171254
1174910
1174913
1174922
1174923
1177943
CVE-2016-9063
CVE-2016-9843
CVE-2017-18207
CVE-2017-18255
CVE-2017-18379
CVE-2017-9233
CVE-2018-1050
CVE-2018-1060
CVE-2018-1061
CVE-2018-12126
CVE-2018-12127
CVE-2018-12130
CVE-2018-1336
CVE-2018-21008
CVE-2018-3058
CVE-2018-3060
CVE-2018-3063
CVE-2018-3064
CVE-2018-3066
CVE-2018-3143
CVE-2018-3156
CVE-2018-3162
CVE-2018-3173
CVE-2018-3174
CVE-2018-3185
CVE-2018-3200
CVE-2018-3251
CVE-2018-3277
CVE-2018-3282
CVE-2018-3284
CVE-2018-8014
CVE-2018-8034
CVE-2018-8037
CVE-2019-11091
CVE-2019-11135
CVE-2019-11139
CVE-2019-12973
CVE-2019-14615
CVE-2019-14811
CVE-2019-14812
CVE-2019-14813
CVE-2019-14817
CVE-2019-14835
CVE-2019-14896
CVE-2019-14897
CVE-2019-18675
CVE-2019-19066
CVE-2019-19319
CVE-2019-19447
CVE-2019-19767
CVE-2019-19768
CVE-2019-19965
CVE-2019-19966
CVE-2019-20054
CVE-2019-20096
CVE-2019-20503
CVE-2019-3701
CVE-2019-3835
CVE-2019-3839
CVE-2019-5108
CVE-2019-9455
CVE-2019-9458
CVE-2020-10690
CVE-2020-10720
CVE-2020-10942
CVE-2020-11494
CVE-2020-11608
CVE-2020-11609
CVE-2020-12653
CVE-2020-12654
CVE-2020-12673
CVE-2020-12674
CVE-2020-14361
CVE-2020-14362
CVE-2020-14779
CVE-2020-14781
CVE-2020-14782
CVE-2020-14792
CVE-2020-14796
CVE-2020-14797
CVE-2020-14798
CVE-2020-14803
CVE-2020-2732
CVE-2020-2756
CVE-2020-2757
CVE-2020-2773
CVE-2020-2781
CVE-2020-2800
CVE-2020-2803
CVE-2020-2805
CVE-2020-2830
CVE-2020-6805
CVE-2020-6806
CVE-2020-6807
CVE-2020-6811
CVE-2020-6812
CVE-2020-6814
CVE-2020-8647
CVE-2020-8648
CVE-2020-8649
CVE-2020-8992
CVE-2020-9383
SUSE-SU-2017:2299-1
SUSE-SU-2018:0754-1
SUSE-SU-2019:0628-1
SUSE-SU-2019:2478-1
SUSE-SU-2019:2959-1
SUSE-SU-2020:0717-1
SUSE-SU-2020:1571-1
SUSE-SU-2020:2274-1
SUSE-SU-2020:2401-1
SUSE-SU-2020:3310-1
Platform(s):openSUSE Leap 15.0
openSUSE Leap 15.1
openSUSE Leap 15.2
SUSE Linux Enterprise Server 12 SP3
SUSE Linux Enterprise Server 12 SP3-BCL
SUSE Linux Enterprise Server 12 SP3-ESPOS
SUSE Linux Enterprise Server 12 SP3-LTSS
SUSE Linux Enterprise Server 12 SP3-TERADATA
SUSE Linux Enterprise Server 12 SP4
SUSE OpenStack Cloud 8
SUSE OpenStack Cloud 9
SUSE OpenStack Cloud Crowbar 8
SUSE OpenStack Cloud Crowbar 9
Product(s):
Definition Synopsis
  • openSUSE Leap 15.0 is installed
  • AND Package Information
  • GraphicsMagick-1.3.29-lp150.3.12 is installed
  • OR GraphicsMagick-devel-1.3.29-lp150.3.12 is installed
  • OR libGraphicsMagick++-Q16-12-1.3.29-lp150.3.12 is installed
  • OR libGraphicsMagick++-devel-1.3.29-lp150.3.12 is installed
  • OR libGraphicsMagick-Q16-3-1.3.29-lp150.3.12 is installed
  • OR libGraphicsMagick3-config-1.3.29-lp150.3.12 is installed
  • OR libGraphicsMagickWand-Q16-2-1.3.29-lp150.3.12 is installed
  • OR perl-GraphicsMagick-1.3.29-lp150.3.12 is installed
    • Definition Synopsis
  • openSUSE Leap 15.1 is installed
  • AND phpMyAdmin-4.9.0.1-31 is installed
    • Definition Synopsis
  • openSUSE Leap 15.2 is installed
  • AND Package Information
  • chromedriver-84.0.4147.135-lp152.2.17 is installed
  • OR chromium-84.0.4147.135-lp152.2.17 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Server 12 SP3 is installed
  • AND Package Information
  • expat-2.1.0-21.3 is installed
  • OR libexpat1-2.1.0-21.3 is installed
  • OR libexpat1-32bit-2.1.0-21.3 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Server 12 SP3-BCL is installed
  • AND Package Information
  • ghostscript-9.27-23.28 is installed
  • OR ghostscript-x11-9.27-23.28 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Server 12 SP3-ESPOS is installed
  • AND Package Information
  • kernel-default-4.4.180-94.116 is installed
  • OR kernel-default-base-4.4.180-94.116 is installed
  • OR kernel-default-devel-4.4.180-94.116 is installed
  • OR kernel-default-kgraft-4.4.180-94.116 is installed
  • OR kernel-devel-4.4.180-94.116 is installed
  • OR kernel-macros-4.4.180-94.116 is installed
  • OR kernel-source-4.4.180-94.116 is installed
  • OR kernel-syms-4.4.180-94.116 is installed
  • OR kgraft-patch-4_4_180-94_116-default-1-4.3 is installed
  • OR kgraft-patch-SLE12-SP3_Update_31-1-4.3 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Server 12 SP3-LTSS is installed
  • AND Package Information
  • kgraft-patch-4_4_176-94_88-default-4-2 is installed
  • OR kgraft-patch-SLE12-SP3_Update_24-4-2 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Server 12 SP3-TERADATA is installed
  • AND Package Information
  • libpython2_7-1_0-2.7.13-28.8 is installed
  • OR libpython2_7-1_0-32bit-2.7.13-28.8 is installed
  • OR python-2.7.13-28.8 is installed
  • OR python-32bit-2.7.13-28.8 is installed
  • OR python-base-2.7.13-28.8 is installed
  • OR python-base-32bit-2.7.13-28.8 is installed
  • OR python-curses-2.7.13-28.8 is installed
  • OR python-demo-2.7.13-28.8 is installed
  • OR python-doc-2.7.13-28.8 is installed
  • OR python-doc-pdf-2.7.13-28.8 is installed
  • OR python-gdbm-2.7.13-28.8 is installed
  • OR python-idle-2.7.13-28.8 is installed
  • OR python-tk-2.7.13-28.8 is installed
  • OR python-xml-2.7.13-28.8 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Server 12 SP4 is installed
  • AND coolkey-1.1.0-148.3 is installed
    • Definition Synopsis
  • SUSE OpenStack Cloud 8 is installed
  • AND Package Information
  • galera-3-25.3.24-4.3 is installed
  • OR galera-3-wsrep-provider-25.3.24-4.3 is installed
  • OR libmariadb3-3.0.6-3.6 is installed
  • OR mariadb-10.2.21-4.8 is installed
  • OR mariadb-client-10.2.21-4.8 is installed
  • OR mariadb-connector-c-3.0.6-3.6 is installed
  • OR mariadb-errormessages-10.2.21-4.8 is installed
  • OR mariadb-galera-10.2.21-4.8 is installed
  • OR mariadb-tools-10.2.21-4.8 is installed
    • Definition Synopsis
  • SUSE OpenStack Cloud 9 is installed
  • AND Package Information
  • tomcat-9.0.36-3.42 is installed
  • OR tomcat-admin-webapps-9.0.36-3.42 is installed
  • OR tomcat-docs-webapp-9.0.36-3.42 is installed
  • OR tomcat-el-3_0-api-9.0.36-3.42 is installed
  • OR tomcat-javadoc-9.0.36-3.42 is installed
  • OR tomcat-jsp-2_3-api-9.0.36-3.42 is installed
  • OR tomcat-lib-9.0.36-3.42 is installed
  • OR tomcat-servlet-4_0-api-9.0.36-3.42 is installed
  • OR tomcat-webapps-9.0.36-3.42 is installed
    • Definition Synopsis
  • SUSE OpenStack Cloud Crowbar 8 is installed
  • AND ucode-intel-20191112-13.53 is installed
    • Definition Synopsis
  • SUSE OpenStack Cloud Crowbar 9 is installed
  • AND Package Information
  • java-1_7_1-ibm-1.7.1_sr4.70-38.56 is installed
  • OR java-1_7_1-ibm-alsa-1.7.1_sr4.70-38.56 is installed
  • OR java-1_7_1-ibm-devel-1.7.1_sr4.70-38.56 is installed
  • OR java-1_7_1-ibm-jdbc-1.7.1_sr4.70-38.56 is installed
  • OR java-1_7_1-ibm-plugin-1.7.1_sr4.70-38.56 is installed
    • BACK