CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:N/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
AI Score
Confidence
High
EPSS
Percentile
66.2%
xbcrypt in Percona XtraBackup before 2.3.6 and 2.4.x before 2.4.5 does not properly set the initialization vector (IV) for encryption, which makes it easier for context-dependent attackers to obtain sensitive information from encrypted backup files via a Chosen-Plaintext attack. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-6394.
Vendor | Product | Version | CPE |
---|---|---|---|
percona | xtrabackup | * | cpe:2.3:a:percona:xtrabackup:*:*:*:*:*:*:*:* |
percona | xtrabackup | 2.4.0 | cpe:2.3:a:percona:xtrabackup:2.4.0:rc1:*:*:*:*:*:* |
percona | xtrabackup | 2.4.1 | cpe:2.3:a:percona:xtrabackup:2.4.1:*:*:*:*:*:*:* |
percona | xtrabackup | 2.4.2 | cpe:2.3:a:percona:xtrabackup:2.4.2:*:*:*:*:*:*:* |
percona | xtrabackup | 2.4.3 | cpe:2.3:a:percona:xtrabackup:2.4.3:*:*:*:*:*:*:* |
percona | xtrabackup | 2.4.4 | cpe:2.3:a:percona:xtrabackup:2.4.4:*:*:*:*:*:*:* |
opensuse | leap | 42.1 | cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:* |
opensuse | leap | 42.2 | cpe:2.3:o:opensuse:leap:42.2:*:*:*:*:*:*:* |
fedoraproject | fedora | 24 | cpe:2.3:o:fedoraproject:fedora:24:*:*:*:*:*:*:* |
fedoraproject | fedora | 25 | cpe:2.3:o:fedoraproject:fedora:25:*:*:*:*:*:*:* |
lists.opensuse.org/opensuse-updates/2017-01/msg00125.html
lists.opensuse.org/opensuse-updates/2017-01/msg00126.html
bugs.launchpad.net/percona-xtrabackup/+bug/1643949
github.com/percona/percona-xtrabackup/pull/266
github.com/percona/percona-xtrabackup/pull/267
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BAHI6ETS22FJCMLW7A6SICFKQXF5G2VI/
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBVCP6KLFVGG6HSGLHLTMZRD6C4IJSZP/
www.percona.com/blog/2017/01/12/cve-2016-6225-percona-xtrabackup-encryption-iv-not-set-properly/
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:N/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
AI Score
Confidence
High
EPSS
Percentile
66.2%