CVE-2020-13249 json
libmariadb/mariadb_lib.c in MariaDB Connector/C before 3.1.8 does not properly validate the content of an OK packet received from a server.
published 6y ago modified 3mo ago also EUVD-2020-5514 , JLSEC-2026-211
- cvss
- 8.8
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.3%
- EPSS 2.3% chance of exploitation in 30 days, percentile 83%
- public exploits
- 0
- none known
Summary
libmariadb/mariadb_lib.c in MariaDB Connector/C before 3.1.8 does not properly validate the content of an OK packet received from a server. NOTE: although mariadb_lib.c was originally based on code shipped for MySQL, this issue does not affect any MySQL components supported by Oracle.
Patch / fix
- julia MariaDB_Connector_C_jll 3.1.12+0
- mariadb connector/c 3.1.8
- mariadb-10.1 Ubuntu 18.04 LTS 1:10.1.47-0ubuntu0.18.04.1
- mariadb-10.3 Ubuntu 20.04 LTS 1:10.3.25-0ubuntu0.20.04.1
ubuntu advisories UBUNTU-CVE-2020-13249
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- Judy RHEL 8, RHEL 8.2 EUS, RHEL 8.1 EUS +1 more 1.0.5-18.module+el8+2765+cfa4f87b
- rh-mariadb103-galera RHEL 3 SOFTWARE_COLLECTIONS 25.3.31-1.el7
- rh-mariadb103-mariadb RHEL 3 SOFTWARE_COLLECTIONS 3:10.3.27-1.el7
- rh-mariadb103-mariadb-test RHEL 3 SOFTWARE_COLLECTIONS 3:10.3.27-1.el7
- rh-mariadb103-mariadb-backup RHEL 3 SOFTWARE_COLLECTIONS 3:10.3.27-1.el7
- rh-mariadb103-mariadb-common RHEL 3 SOFTWARE_COLLECTIONS 3:10.3.27-1.el7
- rh-mariadb103-mariadb-config RHEL 3 SOFTWARE_COLLECTIONS 3:10.3.27-1.el7
- rh-mariadb103-mariadb-errmsg RHEL 3 SOFTWARE_COLLECTIONS 3:10.3.27-1.el7
red hat advisories RHSA-2020:5654RHSA-2020:5663RHSA-2020:5662RHSA-2020:5660RHSA-2020:5655RHSA-2020:5665
- mariadb104 SLES for SAP 12 SP5, SLES 12 SP5, SLE Software Development Kit 12 SP5 10.4.30-8.5.46
- lz4 SLES for SAP 12 SP5, SLES 12 SP5, SLE Software Development Kit 12 SP5 1.8.0-3.5.2
- python-mysqlclient SLES for SAP 12 SP5, SLES 12 SP5, SLE Software Development Kit 12 SP5 1.3.14-8.9.2
- mariadb-connector-c SLES for SAP 12 SP5, SLES 12 SP5, SLE Software Development Kit 12 SP5 3.1.22-2.35.1
- mariadb OpenStack Cloud 7 10.2.36-19.1
- mariadb SLE Module for Server Applications 15 SP1 10.2.32-3.29.2
- mariadb SLES for SAP 12 SP5, SLES for SAP 12 SP4, SLES 12 SP5 +3 more 10.2.32-3.28.2
- mariadb-connector-c SLES for SAP 12 SP5, SLES for SAP 12 SP4, SLES 12 SP5 +1 more 3.1.8-2.15.1
suse advisories SUSE-RU-2023:4991-1SUSE-RU-2023:3956-1SUSE-SU-2020:3625-1SUSE-SU-2020:1711-1SUSE-SU-2020:1710-1SUSE-SU-2020:1431-1
- mariadb openSUSE Tumbleweed 10.6.4-2.1
- mariadb openSUSE Leap 15.1 10.2.32-lp151.2.15.1
- mariadb-connector-c openSUSE Leap 15.1 3.1.8-lp151.3.12.1
opensuse advisories openSUSE-SU-2024:11038-1openSUSE-SU-2020:0870-1openSUSE-SU-2020:0738-1
- mariadb-connector-c AlmaLinux 8 3.1.11-2.el8_3
- mariadb-connector-c-config AlmaLinux 8 3.1.11-2.el8_3
- Judy AlmaLinux 8 1.0.5-18.module_el8.6.0+2867+72759d2f
- Judy AlmaLinux 8 1.0.5-18.module_el8.5.0+2632+14ced695
- Judy AlmaLinux 8 1.0.5-18.module_el8.6.0+2761+593e5e59
almalinux advisories ALSA-2020:5503ALSA-2020:5500
- mariadb-connector-c Rocky Linux 8 3.1.11-2.el8_3
- Judy Rocky Linux 8 1.0.5-18.module+el8.4.0+427+adf35707
rocky linux advisories RLSA-2020:5503RLSA-2020:5500
- mariadb-connector-c Alpine 3.10 3.0.10-r1
- mariadb-connector-c Alpine 3.11 3.1.6-r1
- mariadb-connector-c Alpine 3.9 3.0.8-r1
alpine advisories ALPINE-CVE-2020-13249
Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
Is CVE-2020-13249 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerVendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2020-13249 updated cvss 8.8
mariadb-connector-c: Improper validation of content in a OK packet received from server
-
Red Hat Enterprise Linux AppStream (v. 8) mariadb-connector-c 3.1.11-2.el8_3, Judy 1.0.5-18.module+el8+2765+cfa4f87b, mariadb-connector-c-config 3.1.11-2.el8_3, galera 25.3.31-1.module+el8.3.0+8843+3f4e42f6, mariadb 10.3.27-3.module+el8.3.0+8972+5e3224e9, mariadb-test 10.3.27-3.module+el8.3.0+8972+5e3224e9, +9 morefixed: vendor fix RHSA-2020:5500
-
Red Hat Enterprise Linux AppStream E4S (v. 8.0) mariadb-connector-c 3.1.11-2.el8_0, Judy 1.0.5-18.module+el8+2765+cfa4f87b, mariadb-connector-c-config 3.1.11-2.el8_0, galera 25.3.31-1.module+el8.0.0+9239+73817dd5, mariadb 10.3.27-3.module+el8.0.0+9160+9822c5c7, mariadb-test 10.3.27-3.module+el8.0.0+9160+9822c5c7, +9 morefixed: vendor fix RHSA-2020:5663
-
Red Hat Enterprise Linux AppStream EUS (v. 8.1) mariadb-connector-c 3.1.11-2.el8_1, Judy 1.0.5-18.module+el8+2765+cfa4f87b, mariadb-connector-c-config 3.1.11-2.el8_1, galera 25.3.31-1.module+el8.1.0+8860+1543d51b, mariadb 10.3.27-3.module+el8.1.0+9159+f0191ef0, mariadb-test 10.3.27-3.module+el8.1.0+9159+f0191ef0, +9 morefixed: vendor fix RHSA-2020:5665
-
Red Hat Enterprise Linux AppStream EUS (v. 8.2) mariadb-connector-c 3.1.11-2.el8_2, Judy 1.0.5-18.module+el8+2765+cfa4f87b, mariadb-connector-c-config 3.1.11-2.el8_2, galera 25.3.31-1.module+el8.2.0+8857+d5b3039b, mariadb 10.3.27-3.module+el8.2.0+9158+b3fb2ef4, mariadb-test 10.3.27-3.module+el8.2.0+9158+b3fb2ef4, +9 morefixed: vendor fix RHSA-2020:5654
-
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) rh-mariadb102-galera 25.3.29-1.el6, rh-mariadb102-mariadb 10.2.33-1.el6, rh-mariadb102-mariadb-test 10.2.33-1.el6, rh-mariadb102-mariadb-bench 10.2.33-1.el6, rh-mariadb102-mariadb-backup 10.2.33-1.el6, rh-mariadb102-mariadb-common 10.2.33-1.el6, +14 more Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-mariadb102-galera 25.3.29-1.el7, rh-mariadb103-galera 25.3.31-1.el7, rh-mariadb102-mariadb 10.2.33-1.el7, rh-mariadb103-mariadb 10.3.27-1.el7, rh-mariadb102-mariadb-test 10.2.33-1.el7, rh-mariadb103-mariadb-test 10.3.27-1.el7, +33 more Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-mariadb102-galera 25.3.29-1.el7, rh-mariadb103-galera 25.3.31-1.el7, rh-mariadb102-mariadb 10.2.33-1.el7, rh-mariadb103-mariadb 10.3.27-1.el7, rh-mariadb102-mariadb-test 10.2.33-1.el7, rh-mariadb103-mariadb-test 10.3.27-1.el7, +33 more Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-mariadb102-galera 25.3.29-1.el7, rh-mariadb103-galera 25.3.31-1.el7, rh-mariadb102-mariadb 10.2.33-1.el7, rh-mariadb103-mariadb 10.3.27-1.el7, rh-mariadb102-mariadb-test 10.2.33-1.el7, rh-mariadb103-mariadb-test 10.3.27-1.el7, +33 more Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) rh-mariadb102-galera 25.3.29-1.el6, rh-mariadb102-mariadb 10.2.33-1.el6, rh-mariadb102-mariadb-test 10.2.33-1.el6, rh-mariadb102-mariadb-bench 10.2.33-1.el6, rh-mariadb102-mariadb-backup 10.2.33-1.el6, rh-mariadb102-mariadb-common 10.2.33-1.el6, +14 more Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-mariadb102-galera 25.3.29-1.el7, rh-mariadb103-galera 25.3.31-1.el7, rh-mariadb102-mariadb 10.2.33-1.el7, rh-mariadb103-mariadb 10.3.27-1.el7, rh-mariadb102-mariadb-test 10.2.33-1.el7, rh-mariadb103-mariadb-test 10.3.27-1.el7, +33 morefixed: vendor fix RHSA-2020:4174
-
Red Hat OpenStack Platform 13 (Queens) mariadb, mariadb-libs, mariadb-test, mariadb-common, mariadb-config, mariadb-errmsg, +3 morenot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Exploit prediction
2.30% chance of exploitation in the next 30 days, higher than 83% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P |
| OSV | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| julia | MariaDB_Connector_C_jll | <3.1.12+0 |
3.1.12+0 |
References
-
github.com
/mariadb-corporation/mariadb-connector-c/commit/2759b87d72926b7c9b5426437a7c8dd15ff57945
patch, third-party-advisory, web
-
lists.opensuse.org
/opensuse-security-announce/2020-05/msg00064.html
vendor-advisory, mailing-list, third-party-advisory, web
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/UW2ED32VEUHXFN2J3YQE27JIBV4SC2PI/
vendor-advisory, web
-
lists.opensuse.org
/opensuse-security-announce/2020-06/msg00054.html
vendor-advisory, broken-link, mailing-list, third-party-advisory, web
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/X4X2BMF3EILMTXGOZDTPYS3KT5VWLA2P/
vendor-advisory, web
-
github.com
/mariadb-corporation/mariadb-connector-c/compare/v3.1.7...v3.1.8
release-notes, third-party-advisory, web
Sources
- CVE List CVE-2020-13249
- NVD CVE-2020-13249
- OSV JLSEC-2026-211
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.