Headline
Gentoo Linux Security Advisory 202408-15
Gentoo Linux Security Advisory 202408-15 - Multiple vulnerabilities have been discovered in Percona XtraBackup, the worst of which could lead to arbitrary code execution. Versions greater than or equal to 8.0.29.22 are affected.
Gentoo Linux Security Advisory GLSA 202408-15
https://security.gentoo.org/
Severity: Normal
Title: Percona XtraBackup: Multiple Vulnerabilities
Date: August 09, 2024
Bugs: #849389, #908033
ID: 202408-15
Synopsis
Multiple vulnerabilities have been discovered in Percona XtraBackup, the
worst of which could lead to arbitrary code execution.
Background
Percona XtraBackup is a complete and open source online backup solution
for all versions of MySQL.
Affected packages
Package Vulnerable Unaffected
dev-db/percona-xtrabackup < 8.0.29.22 >= 8.0.29.22
dev-db/percona-xtrabackup-bin < 8.0.29.22 Vulnerable!
Description
Multiple vulnerabilities have been discovered in Percona XtraBackup.
Please review the CVE identifiers referenced below for details.
Impact
Please review the referenced CVE identifiers for details.
Workaround
There is no known workaround at this time.
Resolution
All Percona XtraBackup users should upgrade to the latest version:
emerge --sync
emerge --ask --oneshot --verbose “>=dev-db/percona-xtrabackup-8.0.29.22”
Gentoo has discontinued support for the binary package. Users should
remove this from their system:
emerge --sync
emerge --ask --verbose --depclean “dev-db/percona-xtrabackup-bin”
References
[ 1 ] CVE-2022-25834
https://nvd.nist.gov/vuln/detail/CVE-2022-25834
[ 2 ] CVE-2022-26944
https://nvd.nist.gov/vuln/detail/CVE-2022-26944
Availability
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
https://security.gentoo.org/glsa/202408-15
Concerns?
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users’ machines is of utmost
importance to us. Any security concerns should be addressed to
[email protected] or alternatively, you may file a bug at
https://bugs.gentoo.org.
License
Copyright 2024 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
https://creativecommons.org/licenses/by-sa/2.5
Related news
Ubuntu Security Notice 6745-1 - It was discovered that in Percona XtraBackup, a local crafted filename could trigger arbitrary code execution.
In Percona XtraBackup (PXB) through 2.2.24 and 3.x through 8.0.27-19, a crafted filename on the local file system could trigger unexpected command shell execution of arbitrary commands.
Percona XtraBackup 2.4.20 unintentionally writes the command line to any resulting backup file output. This may include sensitive arguments passed at run time. In addition, when --history is passed at run time, this command line is also written to the PERCONA_SCHEMA.xtrabackup_history table. NOTE: this issue exists because of an incomplete fix for CVE-2020-10997.