CVE-2022-26944

EUVD-2022-31489
Percona XtraBackup 2.4.20 unintentionally writes the command line to any resulting backup file output. This may include sensitive arguments passed at run time. In addition, when --history is passed at run time, this command line is also written to the PERCONA_SCHEMA.xtrabackup_history table. NOTE: this issue exists because of an incomplete fix for CVE-2020-10997.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 59%
Affected Products (NVD)
VendorProductVersion
perconaxtrabackup
2.4.20
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
percona-xtrabackup
bionic
not-affected
focal
dne
impish
dne
jammy
dne
kinetic
dne
lunar
dne
trusty
dne
xenial
not-affected
References
https://docs.percona.com/percona-xtrabackup/2.4/release-notes/2.4/2.4.25.html
https://jira.percona.com/browse/PXB-2722
https://docs.percona.com/percona-xtrabackup/2.4/release-notes/2.4/2.4.25.html
https://jira.percona.com/browse/PXB-2722