CVE-2015-3152

Published: 16 May 2016

Oracle MySQL before 5.7.3, Oracle MySQL Connector/C (aka libmysqlclient) before 6.1.3, and MariaDB before 5.5.44 use the --ssl option to mean that SSL is optional, which allows man-in-the-middle attackers to spoof servers via a cleartext-downgrade attack, aka a "BACKRONYM" attack.

Notes

The MySQL documentation makes the behavior of the --ssl option clear.
It isn't known if they'll release updates for the 5.5/5.6 series.

not included in 5.5.47 or 5.6.28.
Marking this issue as "ignored" since it doesn't look like
upstream is going to fix this in 5.5 and 5.6, and we aren't
going to diverge from upstream.

Status

Severity score breakdown

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3152
• http://www.ocert.org/advisories/ocert-2015-003.html
• http://dev.mysql.com/doc/relnotes/mysql/5.7/en/news-5-7-3.html
• http://mysqlblog.fivefarmers.com/2015/04/29/ssltls-in-5-6-and-5-5-ocert-advisory/
• NVD
• Launchpad
• Debian