CVE-2020-13249

HIGH 8.8CVE-2020-13249 · Published 20/05/2020 · updated 17/06/2026

In short

CVE-2020-13249 is a HIGH (CVSS 8.8) vulnerability affecting connector/c (mariadb).
Chance of exploitation in the next 30 days (EPSS): 2.4%, higher than 84.0% of all vulnerabilities.
Fix: update to 3.1.8 or later.

Package	Affected versions	Patched versions
connector/c mariadb	`< 3.1.8`	`3.1.8`

Description

libmariadb/mariadb_lib.c in MariaDB Connector/C before 3.1.8 does not properly validate the content of an OK packet received from a server. NOTE: although mariadb_lib.c was originally based on code shipped for MySQL, this issue does not affect any MySQL components supported by Oracle.

References

lists.opensuse.org/opensuse-security-announce/2020-05/msg00064.html · Mailing List
lists.opensuse.org/opensuse-security-announce/2020-06/msg00054.html · Broken Link
mariadb-corporation/mariadb-connector-c commit 2759b87 · Patch
mariadb-corporation/mariadb-connector-c · Release Notes
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UW2ED32VEUHXFN2J3YQE27JIBV4SC2PI
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X4X2BMF3EILMTXGOZDTPYS3KT5VWLA2P

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free