Ubuntu
mysql-5.5 package

Serious regression in replication caused by fix for CVE-2012-4414

Bug #1154675 reported by Clint Byrum
10
This bug affects 1 person
Affects Status Importance Assigned to Milestone
MySQL Server
Unknown
Unknown
mysql-5.5 (Debian)
Fix Released
Unknown
mysql-5.5 (Ubuntu)
Fix Released
High
Unassigned

Bug Description

According to this blog post by Stewart Smith:

http://www.mysqlperformanceblog.com/2013/01/13/cve-2012-4414-in-mysql-5-5-29-and-percona-server-5-5-29/

It looks like 5.5.29 has a serious problem with replication. This basically leaves CVE-2012-4414 only half-fixed.

CVE References

Revision history for this message
Clint Byrum (clint-fewbar) wrote :

There is a known working patch that has been applied in Percona Server and MariaDB, including regression tests. I have tested this patch in Debian and it seems to work.

The patch is available in the Debian packaging svn mirror. It is for 5.5.30.. but can be fixed fairly easily for 5.5.29 (just the extra comments in the mdev test's results have to be removed)

http://anonscm.debian.org/viewvc/pkg-mysql/mysql-5.5/branches/unstable/debian/patches/debian-mdev382-fixup.patch?revision=2217&view=markup

Revision history for this message
Serge Hallyn (serge-hallyn) wrote : confirmed

Thanks for filing this bug. Marking it confirmed (due to the references)
and high priority.

 status: confirmed
 importance: high

Changed in mysql-5.5 (Ubuntu):
importance: Undecided → High
status: New → Confirmed
Bug Watch Updater (bug-watch-updater)
Changed in mysql-5.5 (Debian):
status: Unknown → Fix Committed
Bug Watch Updater (bug-watch-updater)
Changed in mysql-5.5 (Debian):
status: Fix Committed → Fix Released
Revision history for this message
Clint Byrum (clint-fewbar) wrote :

http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-31.html

Released on 4/5, with "No changelog".

This means security fixes are -a- comin.

Revision history for this message
Morgan Tocker (morgo) wrote :

The references on the mysqlperformanceblog.com post link to two upstream bugs:
MySQL Bug #68045
MySQL Bug #68045

Both have since been fixed, and with Ubuntu now at 5.5.35 should this bug be closed?

Revision history for this message
Robie Basak (racb) wrote :

Marking closed. Based on Morgan's comment, we believe this to be fixed. If this is wrong, please reopen.

Changed in mysql-5.5 (Ubuntu):
status: Confirmed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.