CVE-2020-10996 – Percona XtraDB Cluster SST script static key

By

CVE-2020-10996

 

Percona XtraDB Cluster versions greater than 5.7.22-29.26 and less than 5.7.28-31.42.1 contained a script that handled SST transfers to nodes, this was inadvertently set to a static value due to an error in the bash script handling this process.

 

Applicability

Time based access to SST files is required in order to exploit this error, as sst files are ephemeral in nature the window in which an attacker with access to the filesystem can exploit this issue is limited.

In addition to the enablement of innodb at-rest encryption, which is not considered a GA feature at the time of writing.

Credits

 

Percona would like to thank Pavel Kasko for discovering this issue, and working to aid resolution.

 

More Information

 

 

Release notes

 


by David Busby via Percona Database Performance Blog

Comments

Post a Comment