Bug 833742 - (CVE-2012-2750) CVE-2012-2750 mysql: unspecified flaw related to Optimizer
CVE-2012-2750 mysql: unspecified flaw related to Optimizer
Status: CLOSED CANTFIX
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
impact=moderate,public=20120412,repor...
: Reopened, Security
Depends On:
Blocks: mysql-cpu-2012-07 833743
  Show dependency treegraph
 
Reported: 2012-06-20 04:41 EDT by Tomas Hoger
Modified: 2013-12-12 05:29 EST (History)
3 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2013-12-11 08:06:33 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Novell 767849 None None None 2012-06-20 04:43:56 EDT

  None (edit)
Description Tomas Hoger 2012-06-20 04:41:16 EDT
MySQL version 5.5.23 releases notes mention following security fix:

 * Security Fix: Bug #59533 was fixed.

 http://dev.mysql.com/doc/refman/5.5/en/news-5-5-23.html

Upstream bug is currently private and there's no additional info currently available for this issue.  The bug is not referenced by any commit in the upstream bazaar repositories.

  http://bugs.mysql.com/bug.php?id=59533
Comment 1 Tomas Hoger 2012-07-25 04:31:40 EDT
There's still no information available for this issue even after the released of Oracle July 2012 CPU:
  http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html

Of the CVEs listed in the CPU, there's only one listed as fixed in 5.5.23:

  CVE-2012-1689  Server Optimizer  4.0/AV:N/AC:L/Au:S/C:N/I:N/A:P+

CVE-2012-1689 is also listed to affected 5.1 before 5.1.63.  We currently have no way to know if CVE-2012-1689 is a duplicate of CVE-2012-2750, whether CVE-2012-1689 was used to refer to more than one issue, or whether it's completely different issue and CVE-2012-2750 is not covered by upstream CPU at all.
Comment 2 Tomas Hoger 2012-08-03 05:44:35 EDT
CVE-2012-1689 has separate bug #841351.
Comment 3 Tomas Hoger 2012-10-31 09:57:30 EDT
As noted in comment #1, this is most likely a duplicate or subset of other CVE listed in Oracle July 2012 CPU.  However, Oracle refused to provide any additional details on the CVE, even limited to confirming which ids are duplicates.  Closing, as this can not be addressed.
Comment 4 Vincent Danen 2013-10-16 14:29:41 EDT
This is noted in the Oracle October 2013 CPU:

http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html#AppendixMSQL

and is noted as affecting the Optimizer sub-component.  As a result, I do not believe this is a duplicate (although, arguably, there's not much more information here than we had to begin with).
Comment 5 Tomas Hoger 2013-12-11 08:06:33 EST
(In reply to Vincent Danen from comment #4)
> This is noted in the Oracle October 2013 CPU:
> 
> http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html#AppendixMSQL
> 
> and is noted as affecting the Optimizer sub-component.

Note that the info in October 2013 CPU does not contradict info noted in comment #1 in any way:

- both CVE-2012-1689 and CVE-2012-2750 are listed as affecting Optimizer component
- both ids have the same CVSS score and vector
- both are listed as fixed in 5.5.23 (i.e. long before Oct CPU 2013)
- there is no fixed in version for 5.1 listed for CVE-2012-2750

> As a result, I do not believe this is a duplicate (although, arguably,
> there's not much more information here than we had to begin with).

Listing of CVE-2012-2750 in Oct CPU 2013 may well be an attempt to stop queries they get regarding the MySQL CVE that was not listed in any previous CPU without providing any useful information (e.g. by confirming relationship to CVE-2012-1689).

MySQL 5.5 shipped in Red Hat products - mysql55-mysql in Red Hat Enterprise Linux 5, and Red Hat Software Collections 1, are based on newer upstream MySQL versions (5.5.32 currently) and hence should have both CVEs fixed.  There's insufficient information available to know if MySQL 5.1 is fixed an in what version.

Note You need to log in before you can comment on or make changes to this bug.