CVE-2020-10996 – Percona XtraDB Cluster SST script static key



Percona XtraDB Cluster versions greater than 5.7.22-29.26 and less than 5.7.28-31.42.1 contained a script that handled SST transfers to nodes, this was inadvertently set to a static value due to an error in the bash script handling this process.



Time based access to SST files is required in order to exploit this error, as sst files are ephemeral in nature the window in which an attacker with access to the filesystem can exploit this issue is limited.

In addition to the enablement of innodb at-rest encryption, which is not considered a GA feature at the time of writing.



Percona would like to thank Pavel Kasko for discovering this issue, and working to aid resolution.


More Information



Release notes


by David Busby via Percona Database Performance Blog