NetSight
IP …
medium5.9

CVE-2015-3152

Oracle MySQL before 5.7.3, Oracle MySQL Connector/C (aka libmysqlclient) before 6.1.3, and MariaDB before 5.5.44 use the --ssl option to mean that SSL is optio…

Impact

Oracle MySQL before 5.7.3, Oracle MySQL Connector/C (aka libmysqlclient) before 6.1.3, and MariaDB before 5.5.44 use the --ssl option to mean that SSL is optional, which allows man-in-the-middle attackers to spoof servers via a cleartext-downgrade attack, aka a "BACKRONYM" attack.

Affected products

VendorProductAffected versions
OracleMysql
through 5.7.2
OracleMysql Connector\/C
through 6.1.2
MariadbMariadb
from 5.5.0 before 5.5.44
from 10.0.0 before 10.0.20
FedoraprojectFedora
Versions 21, 22
DebianDebian Linux
Version 8.0
RedhatEnterprise Linux Desktop
Version 7.0
RedhatEnterprise Linux Eus
Versions 7.1, 7.2, 7.3, 7.4, 7.5, 7.6
RedhatEnterprise Linux Server
Version 7.0
RedhatEnterprise Linux Server Aus
Versions 7.3, 7.4, 7.6, 7.7
RedhatEnterprise Linux Server Tus
Versions 7.3, 7.6, 7.7
RedhatEnterprise Linux Workstation
Version 7.0
PhpPhp
from 5.4.0 before 5.4.43
from 5.5.0 before 5.5.27
from 5.6.0 before 5.6.11

Weakness classification

CWE-295

References