CVE-2020-15180

Name	CVE-2020-15180
Description	A flaw was found in the mysql-wsrep component of mariadb. Lack of input sanitization in `wsrep_sst_method` allows for command injection that can be exploited by a remote attacker to execute arbitrary commands on galera cluster nodes. This threatens the system's confidentiality, integrity, and availability. This flaw affects mariadb versions before 10.1.47, before 10.2.34, before 10.3.25, before 10.4.15 and before 10.5.6.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)
References	DLA-2409-1, DSA-4776-1
Debian Bugs	972746

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
mariadb-10.3 (PTS)	buster	1:10.3.34-0+deb10u1	fixed
	buster (security)	1:10.3.38-0+deb10u1	fixed
mariadb-10.5 (PTS)	bullseye	1:10.5.18-0+deb11u1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
mariadb-10.1	source	stretch	10.1.47-0+deb9u1	DLA-2409-1
mariadb-10.1	source	(unstable)	(unfixed)
mariadb-10.3	source	experimental	1:10.3.27-1~exp1
mariadb-10.3	source	buster	1:10.3.25-0+deb10u1	DSA-4776-1
mariadb-10.3	source	(unstable)	(unfixed)		972746
mariadb-10.5	source	(unstable)	1:10.5.6-1
percona-xtradb-cluster-5.5	source	(unstable)	(unfixed)

Notes

Fixed in MariaDB 10.5.6, 10.4.15, 10.3.25, 10.2.34, 10.1.47
https://jira.mariadb.org/browse/MDEV-23884
https://www.percona.com/blog/2020/10/30/cve-2020-15180-affects-percona-xtradb-cluster/