libmariadb3 fails to include caching_sha2_password.so

[Daniel Black]

The lack of this shared library means MySQL/MariaDB client connectors connecting to a MySQL-8.0 server (which defaults to caching_sha2_password being the default authentication for users, will get a connection rejected message.

This leads to extremely popular work around answers like https://stackoverflow.com/questions/54099722/how-to-connect-r-to-mysql-failed-to-connect-to-database-error-plugin-caching/54101124#54101124 which is very good for popularity scores, but not users.

It was reported in Debian https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=962597 ( for perl connectors) but wasn't fixed for buster.

As Ubuntu is also linking against gnutls the sha256_password.so probably isn't possible. Something to do with missing OEPC(?) missing from gnutls. This has limited use so its a significant problem if this can't be added.

MariaDB is fixing this in their upstream packages (https://jira.mariadb.org/browse/MDEV-24728) from 10.2+ on all debian and ubuntu versions https://github.com/MariaDB/server/commit/57531b32774ffafcd2b8da763c4da859380e3f7d ).

This applies to focal only. As this is the distribution that includes MySQL-8.0 this is important for local database connections.

groovy includes caching_sha2_password but not sha256_password
https://packages.ubuntu.com/groovy/amd64/libmariadb3/filelist

bionic is based on connector/c version is 3.0.3 however it wasn't added upstream until 3.0.8 (https://jira.mariadb.org/browse/CONC-312).

fix: add to debian/libmariadb3.install

/usr/lib/*/mariadb19/plugin/caching_sha2_password.so

[Faustin (fauust)]

Hi Daniel!
Thanks for this very detailed and useful report.

The fix was merged 2 weeks ago https://salsa.debian.org/mariadb-team/mariadb-10.3/-/merge_requests/30 but I am not sure when it will hit Ubuntu.

Maybe Otto could confirm?

[Otto Kekäläinen (otto)]

The MR linked above was merged on the Buster branch, see https://salsa.debian.org/mariadb-team/mariadb-10.3/-/network/buster

It is not on the Ubuntu branches currently.

The Buster branch is also not yet uploaded, as it is pending permission from Debian release managers to get uploaded in https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=988255

I changed the metadata of this Launchpad issue to indicate the severity of the issue, and will later champion this change into a stable Ubuntu release update.

[Faustin (fauust)]

As said in https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=988255 the fix will be provided in next Debian 10.10 update point.

@otto, I have no idea when this will hit Ubuntu though.

[Otto Kekäläinen (otto)]

At https://tracker.debian.org/pkg/mariadb-10.3 one can see the overview for MariaDB 10.3.

The bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=988255 was fixed in 1:10.3.29-0+deb10u1 which is now in Debian stable (Buster) and from https://launchpad.net/ubuntu/+source/mariadb-10.3 one can see that 1:10.3.29-0ubuntu0.20.10.1 is in Groovy and 1:10.3.29-0ubuntu0.20.04.1 in Focal.

However the commit https://salsa.debian.org/mariadb-team/mariadb-10.3/-/commit/4562041f1afdcce5a313fc70478a0fbf789966a1 went only on the Buster branch on Salsa. We need to apply it also on the Groovy and Focal branches next time we upload. MariaDB 10.3.10 would be a candidate, but it is not a security release. I don't remember if we ever shipped "stable udpates" into Ubuntu and what is the process. Maybe we will wait until August for 10.3.31 and put this commit in there..?

[Daniel Black (daniel-black)]

This is a critical bug. More so on Ubuntu because of it installing MySQL by default. It affects all default connections to the MySQL with MariaDB connector/C and its dependent library, and every application that depends on this libmariadb3.

I thought the merge 5 months ago into buster would of made it to the 2 months ago 10.2.29 release. Odd, but so was the 10.5 only #962597 fix.

If you don't want to package 10.3.30 because it only includes bug fixes and not security fixes, ok, but package increment on libmariadb3-1:10.3.29 to resolve this please.

[Otto Kekäläinen (otto)]

Filed https://bugs.launchpad.net/ubuntu/+source/mariadb-10.3/+bug/1936727 to get SRU into Ubuntu, following steps outlined at https://wiki.ubuntu.com/StableReleaseUpdates

[Launchpad Janitor (janitor)]

This bug was fixed in the package mariadb-10.3 - 1:10.3.30-0ubuntu0.20.04.1

---------------
mariadb-10.3 (1:10.3.30-0ubuntu0.20.04.1) focal-security; urgency=medium

  * New upstream version 10.3.30 includes fixes for a critical bug that
    was compromising the results of some type of queries (subqueries with
    group by): https://jira.mariadb.org/browse/MDEV-25714 (LP: #1936727)
  * Fix Perl executable path in scripts (stop using 'env') (Closes: #991472)
    Upstream MariaDB has broken shebangs (#!/usr/bin/env perl) in several
    scripts, thus rendering them potentially loading the wrong Perl version
    and rendering the scripts unusable. Fixing the shebang recovers correct
    behaviour.

  [ Daniel Black ]
  * Add caching_sha2_password.so (Closes: #962597) (LP: #1913676)

 -- Otto Kekäläinen <email address hidden> Sat, 17 Jul 2021 15:59:58 -0700