lp:~dage/mysql-mmm/cve-fix

Branch merges

Propose for merging

No branches dependent on this one.

Merged into lp:mysql-mmm at revision 149

David Beveridge: Approve on 2018-05-04

Diff: 85 lines (+21/-1)

4 files modified

lib/Agent/Helpers.pm (+4/-0)
lib/Agent/Helpers/Network.pm (+15/-0)
lib/Common/Role.pm (+1/-1)
lib/Common/Socket.pm (+1/-0)

api

Related source package recipes

No recipes using this branch. (?)

Create packaging recipe

Related snap packages

Related bugs

Bug #1736962: Multi-Master Replication Manager for MySQL mmm_agentd Remote Command Injection Vulnerabilities

High

Fix Released

Link a bug report

Related blueprints

149. By David Beveridge on 2018-05-04

Fix for TALOS-2017-0501; CVE-2017-14474 - CVE-2017-14481

Multi-Master Replication Manager for MySQL mmm_agentd Remote Command Injection Vulnerabilities

Multiple exploitable remote command injection vulnerabilities exist
in the MySQL Master-Master Replication Manager (MMM) mmm_agentd
daemon 2.2.1. mmm_agentd commonly runs with root privileges and does not
require authentication by default. A specially crafted MMM protocol
message can cause a shell command injection resulting in arbitrary
command execution with the privileges of the mmm_agentd process. An
attacker that can initiate a TCP session with mmm_agentd can trigger
these vulnerabilities.

148. By David Beveridge on 2018-04-28

Fix #1766773 bug with newer Net::ARP version numbers

147. By Pascal Hofmann on 2010-05-07

Release 2.2.1

146. By Pascal Hofmann on 2010-05-05

Removed checks for incorrect state REPLICATION_BACKLOG (it's called REPLICATION_DELAY...).

145. By Pascal Hofmann on 2010-03-09

Added missing changelog entry.

144. By Pascal Hofmann on 2010-03-09

Release 2.2.0

143. By Pascal Hofmann on 2010-03-09

Non-buffered log4perl mail example in docs.

142. By Pascal Hofmann on 2010-03-09

Allow running multiple agents on the same host (bug #525719)

141. By Pascal Hofmann on 2010-03-09

  * Added manual mode (bug #531011), wait mode, config values 'mode' and 'wait_for_other_master'
  * Don't die at startup when no network connection is available - wait for it to appear instead (bug #416572)
  * Changed startup behaviour. mmm_mond will only go into passive mode if it detects the active_master_role on more than one host.
  * Added config value 'careful_startup' (bug #422549). If set to 0 mmm_mond won't ever switch into passive mode at startup.
  * Added check for invalid agent commands (prevents crash when mmmd_mon version 1.x talks to an 2.x agent).

140. By Pascal Hofmann on 2010-03-03

Fixed date format for 'mmm_control checks' (bug #531841)