<?xml version="1.0" encoding="UTF-8"?>
<cvrfdoc xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:cvrf="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf" xmlns:cvrf-common="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/common" xmlns:cvssv2="http://scap.nist.gov/schema/cvss-v2/1.0" xmlns:cvssv3="https://www.first.org/cvss/cvss-v3.0.xsd" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:ns0="http://purl.org/dc/elements/1.1/" xmlns:prod="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod" xmlns:scap-core="http://scap.nist.gov/schema/scap-core/1.0" xmlns:sch="http://purl.oclc.org/dsdl/schematron" xmlns:vuln="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf">
  <DocumentTitle xml:lang="en">Security update for mariadb</DocumentTitle>
  <DocumentType>SUSE Patch</DocumentType>
  <DocumentPublisher Type="Vendor">
    <ContactDetails>security@suse.de</ContactDetails>
    <IssuingAuthority>SUSE Security Team</IssuingAuthority>
  </DocumentPublisher>
  <DocumentTracking>
    <Identification>
      <ID>SUSE-SU-2019:2461-1</ID>
    </Identification>
    <Status>Final</Status>
    <Version>1</Version>
    <RevisionHistory>
      <Revision>
        <Number>1</Number>
        <Date>2019-09-25T14:42:54Z</Date>
        <Description>current</Description>
      </Revision>
    </RevisionHistory>
    <InitialReleaseDate>2019-09-25T14:42:54Z</InitialReleaseDate>
    <CurrentReleaseDate>2019-09-25T14:42:54Z</CurrentReleaseDate>
    <Generator>
      <Engine>cve-database/bin/generate-cvrf.pl</Engine>
      <Date>2017-02-24T01:00:00Z</Date>
    </Generator>
  </DocumentTracking>
  <DocumentNotes>
    <Note Title="Topic" Type="Summary" Ordinal="1" xml:lang="en">Security update for mariadb</Note>
    <Note Title="Details" Type="General" Ordinal="2" xml:lang="en">This update for mariadb fixes the following issues:

Updated to MariaDB 10.0.40-1.

Security issues fixed:

- CVE-2019-2805, CVE-2019-2740, CVE-2019-2739, CVE-2019-2737, 
  CVE-2019-2614, CVE-2019-2627. (bsc#1132826) (bsc#1141798).

Non-security issues fixed:

- Adjusted mysql-systemd-helper ('shutdown protected MySQL' section)
  so it checks both ping response and the pid in a process list
  as it can take some time till the process is terminated.
  Otherwise it can lead to 'found left-over process' situation
  when regular mariadb is started. (bsc#1143215)
- Fixed IP resolving in mysql_install_db script. (bsc#1142058, bsc#1127027, MDEV-18526)
</Note>
    <Note Title="Terms of Use" Type="Legal Disclaimer" Ordinal="3" xml:lang="en">The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).</Note>
    <Note Title="Patchnames" Type="Details" Ordinal="4" xml:lang="en">HPE-Helion-OpenStack-8-2019-2461,SUSE-2019-2461,SUSE-OpenStack-Cloud-8-2019-2461,SUSE-OpenStack-Cloud-Crowbar-8-2019-2461</Note>
  </DocumentNotes>
  <DocumentDistribution xml:lang="en">Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0)</DocumentDistribution>
  <DocumentReferences>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/update/announcement/2019/suse-su-20192461-1/</URL>
      <Description>Link for SUSE-SU-2019:2461-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://lists.suse.com/pipermail/sle-security-updates/2019-September/005964.html</URL>
      <Description>E-Mail link for SUSE-SU-2019:2461-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/security/rating/</URL>
      <Description>SUSE Security Ratings</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1127027</URL>
      <Description>SUSE Bug 1127027</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1132826</URL>
      <Description>SUSE Bug 1132826</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1141798</URL>
      <Description>SUSE Bug 1141798</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1142058</URL>
      <Description>SUSE Bug 1142058</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1143215</URL>
      <Description>SUSE Bug 1143215</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2019-2614/</URL>
      <Description>SUSE CVE CVE-2019-2614 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2019-2627/</URL>
      <Description>SUSE CVE CVE-2019-2627 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2019-2737/</URL>
      <Description>SUSE CVE CVE-2019-2737 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2019-2739/</URL>
      <Description>SUSE CVE CVE-2019-2739 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2019-2740/</URL>
      <Description>SUSE CVE CVE-2019-2740 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2019-2805/</URL>
      <Description>SUSE CVE CVE-2019-2805 page</Description>
    </Reference>
  </DocumentReferences>
  <ProductTree xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod">
    <Branch Type="Product Family" Name="HPE Helion OpenStack 8">
      <Branch Type="Product Name" Name="HPE Helion OpenStack 8">
        <FullProductName ProductID="HPE Helion OpenStack 8" CPE="cpe:/o:suse:hpe-helion-openstack:8">HPE Helion OpenStack 8</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE OpenStack Cloud 8">
      <Branch Type="Product Name" Name="SUSE OpenStack Cloud 8">
        <FullProductName ProductID="SUSE OpenStack Cloud 8" CPE="cpe:/o:suse:suse-openstack-cloud:8">SUSE OpenStack Cloud 8</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE OpenStack Cloud Crowbar 8">
      <Branch Type="Product Name" Name="SUSE OpenStack Cloud Crowbar 8">
        <FullProductName ProductID="SUSE OpenStack Cloud Crowbar 8" CPE="cpe:/o:suse:suse-openstack-cloud-crowbar:8">SUSE OpenStack Cloud Crowbar 8</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Version" Name="libmysqlclient18-10.0.40.1-29.32.1">
      <FullProductName ProductID="libmysqlclient18-10.0.40.1-29.32.1">libmysqlclient18-10.0.40.1-29.32.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="libmysqlclient-devel-10.0.40.1-29.32.1">
      <FullProductName ProductID="libmysqlclient-devel-10.0.40.1-29.32.1">libmysqlclient-devel-10.0.40.1-29.32.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="libmysqlclient18-32bit-10.0.40.1-29.32.1">
      <FullProductName ProductID="libmysqlclient18-32bit-10.0.40.1-29.32.1">libmysqlclient18-32bit-10.0.40.1-29.32.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="libmysqlclient18-64bit-10.0.40.1-29.32.1">
      <FullProductName ProductID="libmysqlclient18-64bit-10.0.40.1-29.32.1">libmysqlclient18-64bit-10.0.40.1-29.32.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="libmysqlclient_r18-10.0.40.1-29.32.1">
      <FullProductName ProductID="libmysqlclient_r18-10.0.40.1-29.32.1">libmysqlclient_r18-10.0.40.1-29.32.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="libmysqlclient_r18-32bit-10.0.40.1-29.32.1">
      <FullProductName ProductID="libmysqlclient_r18-32bit-10.0.40.1-29.32.1">libmysqlclient_r18-32bit-10.0.40.1-29.32.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="libmysqlclient_r18-64bit-10.0.40.1-29.32.1">
      <FullProductName ProductID="libmysqlclient_r18-64bit-10.0.40.1-29.32.1">libmysqlclient_r18-64bit-10.0.40.1-29.32.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="libmysqld-devel-10.0.40.1-29.32.1">
      <FullProductName ProductID="libmysqld-devel-10.0.40.1-29.32.1">libmysqld-devel-10.0.40.1-29.32.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="libmysqld18-10.0.40.1-29.32.1">
      <FullProductName ProductID="libmysqld18-10.0.40.1-29.32.1">libmysqld18-10.0.40.1-29.32.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="mariadb-10.0.40.1-29.32.1">
      <FullProductName ProductID="mariadb-10.0.40.1-29.32.1">mariadb-10.0.40.1-29.32.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="mariadb-bench-10.0.40.1-29.32.1">
      <FullProductName ProductID="mariadb-bench-10.0.40.1-29.32.1">mariadb-bench-10.0.40.1-29.32.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="mariadb-client-10.0.40.1-29.32.1">
      <FullProductName ProductID="mariadb-client-10.0.40.1-29.32.1">mariadb-client-10.0.40.1-29.32.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="mariadb-errormessages-10.0.40.1-29.32.1">
      <FullProductName ProductID="mariadb-errormessages-10.0.40.1-29.32.1">mariadb-errormessages-10.0.40.1-29.32.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="mariadb-test-10.0.40.1-29.32.1">
      <FullProductName ProductID="mariadb-test-10.0.40.1-29.32.1">mariadb-test-10.0.40.1-29.32.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="mariadb-tools-10.0.40.1-29.32.1">
      <FullProductName ProductID="mariadb-tools-10.0.40.1-29.32.1">mariadb-tools-10.0.40.1-29.32.1</FullProductName>
    </Branch>
    <Relationship ProductReference="libmysqlclient18-10.0.40.1-29.32.1" RelationType="Default Component Of" RelatesToProductReference="HPE Helion OpenStack 8">
      <FullProductName ProductID="HPE Helion OpenStack 8:libmysqlclient18-10.0.40.1-29.32.1">libmysqlclient18-10.0.40.1-29.32.1 as a component of HPE Helion OpenStack 8</FullProductName>
    </Relationship>
    <Relationship ProductReference="libmysqlclient18-10.0.40.1-29.32.1" RelationType="Default Component Of" RelatesToProductReference="SUSE OpenStack Cloud 8">
      <FullProductName ProductID="SUSE OpenStack Cloud 8:libmysqlclient18-10.0.40.1-29.32.1">libmysqlclient18-10.0.40.1-29.32.1 as a component of SUSE OpenStack Cloud 8</FullProductName>
    </Relationship>
    <Relationship ProductReference="libmysqlclient18-10.0.40.1-29.32.1" RelationType="Default Component Of" RelatesToProductReference="SUSE OpenStack Cloud Crowbar 8">
      <FullProductName ProductID="SUSE OpenStack Cloud Crowbar 8:libmysqlclient18-10.0.40.1-29.32.1">libmysqlclient18-10.0.40.1-29.32.1 as a component of SUSE OpenStack Cloud Crowbar 8</FullProductName>
    </Relationship>
  </ProductTree>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="1">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication). Supported versions that are affected are 5.6.43 and prior, 5.7.25 and prior and 8.0.15 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).</Note>
    </Notes>
    <CVE>CVE-2019-2614</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>HPE Helion OpenStack 8:libmysqlclient18-10.0.40.1-29.32.1</ProductID>
        <ProductID>SUSE OpenStack Cloud 8:libmysqlclient18-10.0.40.1-29.32.1</ProductID>
        <ProductID>SUSE OpenStack Cloud Crowbar 8:libmysqlclient18-10.0.40.1-29.32.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>important</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>3.5</BaseScoreV2>
        <VectorV2>AV:N/AC:M/Au:S/C:N/I:N/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>4.4</BaseScoreV3>
        <VectorV3>CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2019/suse-su-20192461-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2019-2614.html</URL>
        <Description>CVE-2019-2614</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1132826</URL>
        <Description>SUSE Bug 1132826</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1136035</URL>
        <Description>SUSE Bug 1136035</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1141798</URL>
        <Description>SUSE Bug 1141798</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="2">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Privileges). Supported versions that are affected are 5.6.43 and prior, 5.7.25 and prior and 8.0.15 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).</Note>
    </Notes>
    <CVE>CVE-2019-2627</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>HPE Helion OpenStack 8:libmysqlclient18-10.0.40.1-29.32.1</ProductID>
        <ProductID>SUSE OpenStack Cloud 8:libmysqlclient18-10.0.40.1-29.32.1</ProductID>
        <ProductID>SUSE OpenStack Cloud Crowbar 8:libmysqlclient18-10.0.40.1-29.32.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>important</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>4</BaseScoreV2>
        <VectorV2>AV:N/AC:L/Au:S/C:N/I:N/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>4.9</BaseScoreV3>
        <VectorV3>CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2019/suse-su-20192461-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2019-2627.html</URL>
        <Description>CVE-2019-2627</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1132826</URL>
        <Description>SUSE Bug 1132826</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1136035</URL>
        <Description>SUSE Bug 1136035</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1141798</URL>
        <Description>SUSE Bug 1141798</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="3">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server : Pluggable Auth). Supported versions that are affected are 5.6.44 and prior, 5.7.26 and prior and 8.0.16 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).</Note>
    </Notes>
    <CVE>CVE-2019-2737</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>HPE Helion OpenStack 8:libmysqlclient18-10.0.40.1-29.32.1</ProductID>
        <ProductID>SUSE OpenStack Cloud 8:libmysqlclient18-10.0.40.1-29.32.1</ProductID>
        <ProductID>SUSE OpenStack Cloud Crowbar 8:libmysqlclient18-10.0.40.1-29.32.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>4</BaseScoreV2>
        <VectorV2>AV:N/AC:L/Au:S/C:N/I:N/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>4.9</BaseScoreV3>
        <VectorV3>CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2019/suse-su-20192461-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2019-2737.html</URL>
        <Description>CVE-2019-2737</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1132826</URL>
        <Description>SUSE Bug 1132826</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1141798</URL>
        <Description>SUSE Bug 1141798</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1156669</URL>
        <Description>SUSE Bug 1156669</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="4">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Privileges). Supported versions that are affected are 5.6.44 and prior, 5.7.26 and prior and 8.0.16 and prior. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.0 Base Score 5.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H).</Note>
    </Notes>
    <CVE>CVE-2019-2739</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>HPE Helion OpenStack 8:libmysqlclient18-10.0.40.1-29.32.1</ProductID>
        <ProductID>SUSE OpenStack Cloud 8:libmysqlclient18-10.0.40.1-29.32.1</ProductID>
        <ProductID>SUSE OpenStack Cloud Crowbar 8:libmysqlclient18-10.0.40.1-29.32.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>3.6</BaseScoreV2>
        <VectorV2>AV:L/AC:L/Au:N/C:N/I:P/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>5.1</BaseScoreV3>
        <VectorV3>CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2019/suse-su-20192461-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2019-2739.html</URL>
        <Description>CVE-2019-2739</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1132826</URL>
        <Description>SUSE Bug 1132826</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1141798</URL>
        <Description>SUSE Bug 1141798</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1156669</URL>
        <Description>SUSE Bug 1156669</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="5">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: XML). Supported versions that are affected are 5.6.44 and prior, 5.7.26 and prior and 8.0.16 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).</Note>
    </Notes>
    <CVE>CVE-2019-2740</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>HPE Helion OpenStack 8:libmysqlclient18-10.0.40.1-29.32.1</ProductID>
        <ProductID>SUSE OpenStack Cloud 8:libmysqlclient18-10.0.40.1-29.32.1</ProductID>
        <ProductID>SUSE OpenStack Cloud Crowbar 8:libmysqlclient18-10.0.40.1-29.32.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>4</BaseScoreV2>
        <VectorV2>AV:N/AC:L/Au:S/C:N/I:N/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>6.5</BaseScoreV3>
        <VectorV3>CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2019/suse-su-20192461-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2019-2740.html</URL>
        <Description>CVE-2019-2740</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1132826</URL>
        <Description>SUSE Bug 1132826</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1141798</URL>
        <Description>SUSE Bug 1141798</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1156669</URL>
        <Description>SUSE Bug 1156669</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="6">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Parser). Supported versions that are affected are 5.6.44 and prior, 5.7.26 and prior and 8.0.16 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).</Note>
    </Notes>
    <CVE>CVE-2019-2805</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>HPE Helion OpenStack 8:libmysqlclient18-10.0.40.1-29.32.1</ProductID>
        <ProductID>SUSE OpenStack Cloud 8:libmysqlclient18-10.0.40.1-29.32.1</ProductID>
        <ProductID>SUSE OpenStack Cloud Crowbar 8:libmysqlclient18-10.0.40.1-29.32.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>4</BaseScoreV2>
        <VectorV2>AV:N/AC:L/Au:S/C:N/I:N/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>6.5</BaseScoreV3>
        <VectorV3>CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2019/suse-su-20192461-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2019-2805.html</URL>
        <Description>CVE-2019-2805</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1132826</URL>
        <Description>SUSE Bug 1132826</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1141798</URL>
        <Description>SUSE Bug 1141798</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1156669</URL>
        <Description>SUSE Bug 1156669</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
</cvrfdoc>
