Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Encryption). Supported versions that are affected are 5.5.52 and earlier, 5.6.33 and earlier and 5.7.15 and earlier. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Server accessible data.
Created mariadb tracking bugs for this issue:
Affects: fedora-all [bug 1386608]
Created community-mysql tracking bugs for this issue:
Affects: fedora-all [bug 1386607]
Created mariadb-galera tracking bugs for this issue:
Affects: fedora-all [bug 1386609]
This is not a MySQL flaw, but a flaw in embedded yaSSL library:
It is mentioned in the respective MySQL release notes as:
yaSSL was upgraded to version 2.4.2. This upgrade corrects issues with:
Potential AES side channel leaks; ...
Further details form the yaSSL README:
yaSSL Release notes, version 2.4.2 (9/22/2016)
This release of yaSSL fixes a medium security vulnerability. A fix for
potential AES side channel leaks is included that a local user monitoring
the same CPU core cache could exploit. VM users, hyper-threading users,
and users where potential attackers have access to the CPU cache will need
to update if they utilize AES.
MySQL and MariaDB packages included in Red Hat products are built against system OpenSSL packages. They are not using embedded yaSSL, and are therefore not affected by this issue.