CVE-2017-10379 json
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Client programs).
published 2017-10-19 9 y ago modified 2026-06-17 4 mo ago also EUVD-2017-2026
- cvss
- 6.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.3%
- EPSS 2.3% chance of exploitation in 30 days, percentile 83%
- public exploits
- 0
- none known
Summary
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Client programs). Supported versions that are affected are 5.5.57 and earlier, 5.6.37 and earlier and 5.7.19 and earlier. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Server accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Patch / fix
- mariadb mariadb 5.5.57, 10.0.32, 10.1.26, 10.2.8
- mysql-5.5 Ubuntu 14.04 LTS 5.5.58-0ubuntu0.14.04.1
- mysql-5.7 Ubuntu 16.04 LTS 5.7.20-0ubuntu0.16.04.1
- mysql-5.7 Ubuntu 18.04 LTS 5.7.20-0ubuntu0.17.10.1
ubuntu advisories UBUNTU-CVE-2017-10379
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- mariadb RHEL 7 1:5.5.60-1.el7_5
- mariadb-libs RHEL 7 1:5.5.60-1.el7_5
- mariadb-test RHEL 7 1:5.5.60-1.el7_5
- mariadb-bench RHEL 7 1:5.5.60-1.el7_5
- mariadb-server RHEL 7 1:5.5.60-1.el7_5
- mariadb-embedded RHEL 7 1:5.5.60-1.el7_5
- rh-mariadb101-galera RHEL 3 SOFTWARE_COLLECTIONS 25.3.12-12.el6
- rh-mariadb101-galera RHEL 3 SOFTWARE_COLLECTIONS 25.3.12-12.el7
red hat advisories RHSA-2018:2439RHSA-2018:0574RHSA-2018:0279RHSA-2017:3442RHSA-2017:3265
- mariadb104 SLES for SAP 12 SP5, SLES 12 SP5, SLE Software Development Kit 12 SP5 10.4.30-8.5.46
- lz4 SLES for SAP 12 SP5, SLES 12 SP5, SLE Software Development Kit 12 SP5 1.8.0-3.5.2
- python-mysqlclient SLES for SAP 12 SP5, SLES 12 SP5, SLE Software Development Kit 12 SP5 1.3.14-8.9.2
- mariadb-connector-c SLES for SAP 12 SP5, SLES 12 SP5, SLE Software Development Kit 12 SP5 3.1.22-2.35.1
- mariadb OpenStack Cloud 7 10.2.15-7.1
- galera-3 OpenStack Cloud 7 25.3.23-8.3
- xtrabackup OpenStack Cloud 7 2.4.10-5.3
- rubygem-mysql2 OpenStack Cloud 7 0.4.10-7.2
suse advisories SUSE-RU-2023:4991-1SUSE-RU-2023:3956-1SUSE-SU-2018:1853-1SUSE-SU-2017:2996-1
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2017-10379 updated cvss 6.5
mysql: Client programs unspecified vulnerability (CPU Oct 2017)
-
Red Hat Enterprise Linux 5 mysql55-mysql Red Hat Enterprise Linux 6 mysql, mysql-libs, mysql-test, mysql-bench, mysql-server, mysql-embedded Red Hat Enterprise Linux OpenStack Platform 6 (Juno) mariadb-galera Red Hat Enterprise Linux OpenStack Platform 7 (Kilo) mariadb-galera, mariadb-galera-common, mariadb-galera-server Red Hat OpenStack Platform 8 (Liberty) mariadb-galera, mariadb-galera-common, mariadb-galera-server Red Hat OpenStack Platform 9 (Mitaka) mariadb-galera, mariadb-galera-common, mariadb-galera-serveraffected: no fix planned “Will not fix”
+3 more productsfewer
Red Hat OpenStack Platform 10 (Newton) mariadb-galera, mariadb-galera-common, mariadb-galera-server Red Hat OpenStack Platform 11 (Ocata) mariadb-galera Red Hat OpenStack Platform 12 (Pike) mariadb-galera-common, mariadb-galera-server -
Red Hat Enterprise Linux Client (v. 7) mariadb 5.5.60-1.el7_5, mariadb-libs 5.5.60-1.el7_5, mariadb-server 5.5.60-1.el7_5 Red Hat Enterprise Linux Client Optional (v. 7) mariadb-test 5.5.60-1.el7_5, mariadb-bench 5.5.60-1.el7_5, mariadb-embedded 5.5.60-1.el7_5 Red Hat Enterprise Linux ComputeNode (v. 7) mariadb 5.5.60-1.el7_5, mariadb-libs 5.5.60-1.el7_5 Red Hat Enterprise Linux ComputeNode Optional (v. 7) mariadb-test 5.5.60-1.el7_5, mariadb-bench 5.5.60-1.el7_5, mariadb-server 5.5.60-1.el7_5, mariadb-embedded 5.5.60-1.el7_5 Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) mariadb 5.5.60-1.el7_5, mariadb-libs 5.5.60-1.el7_5, mariadb-test 5.5.60-1.el7_5, mariadb-bench 5.5.60-1.el7_5, mariadb-server 5.5.60-1.el7_5 Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) mariadb-embedded 5.5.60-1.el7_5fixed: vendor fix RHSA-2018:2439
+4 more productsfewer
Red Hat Enterprise Linux Server (v. 7) mariadb 5.5.60-1.el7_5, mariadb-libs 5.5.60-1.el7_5, mariadb-test 5.5.60-1.el7_5, mariadb-bench 5.5.60-1.el7_5, mariadb-server 5.5.60-1.el7_5 Red Hat Enterprise Linux Server Optional (v. 7) mariadb-embedded 5.5.60-1.el7_5 Red Hat Enterprise Linux Workstation (v. 7) mariadb 5.5.60-1.el7_5, mariadb-libs 5.5.60-1.el7_5, mariadb-test 5.5.60-1.el7_5, mariadb-bench 5.5.60-1.el7_5, mariadb-server 5.5.60-1.el7_5 Red Hat Enterprise Linux Workstation Optional (v. 7) mariadb-embedded 5.5.60-1.el7_5 -
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) rh-mysql56-mysql 5.6.38-1.el6, rh-mysql57-mysql 5.7.20-1.el6, rh-mysql56-mysql-test 5.6.38-1.el6, rh-mysql57-mysql-test 5.7.20-1.el6, rh-mariadb100-mariadb 10.0.33-3.el6, rh-mariadb101-galera 25.3.12-12.el6, +25 more Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-mysql56-mysql 5.6.38-1.el7, rh-mysql57-mysql 5.7.20-1.el7, rh-mysql56-mysql-test 5.6.38-1.el7, rh-mysql57-mysql-test 5.7.20-1.el7, rh-mariadb100-mariadb 10.0.33-3.el7, rh-mariadb101-galera 25.3.12-12.el7, +25 more Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7) rh-mysql56-mysql 5.6.38-1.el6, rh-mysql57-mysql 5.7.20-1.el6, rh-mysql56-mysql-test 5.6.38-1.el6, rh-mysql57-mysql-test 5.7.20-1.el6, rh-mariadb100-mariadb 10.0.33-3.el6, rh-mariadb101-galera 25.3.12-12.el6, +25 more Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3) rh-mysql56-mysql 5.6.38-1.el7, rh-mysql57-mysql 5.7.20-1.el7, rh-mysql56-mysql-test 5.6.38-1.el7, rh-mysql57-mysql-test 5.7.20-1.el7, rh-mariadb100-mariadb 10.0.33-3.el7, rh-mariadb101-galera 25.3.12-12.el7, +25 more Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4) rh-mysql56-mysql 5.6.38-1.el7, rh-mysql57-mysql 5.7.20-1.el7, rh-mysql56-mysql-test 5.6.38-1.el7, rh-mysql57-mysql-test 5.7.20-1.el7, rh-mariadb100-mariadb 10.0.33-3.el7, rh-mariadb101-galera 25.3.12-12.el7, +25 more Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) rh-mysql56-mysql 5.6.38-1.el6, rh-mysql57-mysql 5.7.20-1.el6, rh-mysql56-mysql-test 5.6.38-1.el6, rh-mysql57-mysql-test 5.7.20-1.el6, rh-mariadb100-mariadb 10.0.33-3.el6, rh-mariadb101-galera 25.3.12-12.el6, +25 morefixed: vendor fix RHSA-2018:0279
+1 more productsfewer
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-mysql56-mysql 5.6.38-1.el7, rh-mysql57-mysql 5.7.20-1.el7, rh-mysql56-mysql-test 5.6.38-1.el7, rh-mysql57-mysql-test 5.7.20-1.el7, rh-mariadb100-mariadb 10.0.33-3.el7, rh-mariadb101-galera 25.3.12-12.el7, +25 more -
Red Hat Software Collections rh-mariadb102-mariadb, rh-mariadb102-mariadb-test, rh-mariadb102-mariadb-bench, rh-mariadb102-mariadb-backup, rh-mariadb102-mariadb-common, rh-mariadb102-mariadb-config, +13 morenot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
2.30% chance of exploitation in the next 30 days, higher than 83% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| NVD | 2.0 | 4.0 | AV:N/AC:L/Au:S/C:P/I:N/A:N |
Classification
- Weakness
-
- CWE-863 Incorrect Authorization
- Technology feeds
References
-
oracle.com
/technetwork/security-advisory/cpuoct2017-3236626.html
patch, vendor-advisory
-
debian.org
/security/2017/dsa-4002
vendor-advisory, third-party-advisory
-
access.redhat.com
/errata/RHSA-2017:3265
vendor-advisory, third-party-advisory
-
access.redhat.com
/errata/RHSA-2018:2729
vendor-advisory, third-party-advisory
-
access.redhat.com
/errata/RHSA-2018:0574
vendor-advisory, third-party-advisory
-
access.redhat.com
/errata/RHSA-2018:0279
vendor-advisory, third-party-advisory
-
access.redhat.com
/errata/RHSA-2018:2439
vendor-advisory, third-party-advisory
-
access.redhat.com
/errata/RHSA-2017:3442
vendor-advisory, third-party-advisory
-
security.netapp.com
/advisory/ntap-20171019-0002/
third-party-advisory
-
securitytracker.com
/id/1039597
vdb-entry, broken-link, third-party-advisory
-
securityfocus.com
/bid/101415
vdb-entry, third-party-advisory
Sources
- CVE List CVE-2017-10379
- NVD CVE-2017-10379
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.