CVSS 3 Base Score:
6.8

Posted On:

Assessed Risk Level:
Medium

In previous versions of puppetlabs-mysql, a bug in username validation can unexpectedly create database user accounts with no password.

If a `mysql_user` user parameter contains a host with a netmask, the database account created does not include the netmask. A subsequent `mysql_grant` for the same user creates a second database account that includes the host and netmask, but has no password. This account could potentially be used to access the database remotely, without authentication.

Users who may have used affected versions of puppetlabs-mysql to manage database accounts containing netmasks should audit puppetlabs-mysql-managed MySQL user tables (for accounts that may have been unexpectedly created) and update to puppetlabs-mysql 3.6.1.

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

Thanks to Stefan Lasiewski for responsibly disclosing this issue to us.

Status:

Affected software versions:
  • puppetlabs-mysql 3.1.0 - 3.6.0
Resolved in:
  • puppetlabs-mysql 3.6.1
← Back to CVE Listings