CVE-2022-26944

Percona XtraBackup 2.4.20 unintentionally writes the command line to any resulting backup file output. This may include sensitive arguments passed at run time. In addition, when --history is passed at run time, this command line is also written to the PERCONA_SCHEMA.xtrabackup_history table. NOTE: this issue exists because of an incomplete fix for CVE-2020-10997.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 43%
VendorProductVersion
perconaxtrabackup
2.4.20
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
percona-xtrabackup
lunar
dne
kinetic
dne
jammy
dne
impish
dne
focal
dne
bionic
not-affected
xenial
not-affected
trusty
dne
References
https://docs.percona.com/percona-xtrabackup/2.4/release-notes/2.4/2.4.25.html
https://jira.percona.com/browse/PXB-2722
https://docs.percona.com/percona-xtrabackup/2.4/release-notes/2.4/2.4.25.html
https://jira.percona.com/browse/PXB-2722