CVE-2018-2767

Name of the Vulnerable Software and Affected Versions: MySQL Server versions 5.5.60 and prior MySQL Server versions 5.6.40 and prior MySQL Server versions 5.7.22 and prior

Description: The issue is related to a lack of protection for service data in the MySQL Server component of Oracle MySQL, specifically in the Server:Security:Encryption subcomponent. This can allow an attacker to gain unauthorized access to confidential data. The vulnerability can be exploited by a low-privileged attacker with network access via multiple protocols, potentially resulting in unauthorized read access to a subset of MySQL Server accessible data.

Recommendations: For MySQL Server version 5.5.60 and prior, update to a version later than 5.5.60 to resolve the issue. For MySQL Server version 5.6.40 and prior, update to a version later than 5.6.40 to resolve the issue. For MySQL Server version 5.7.22 and prior, update to a version later than 5.7.22 to resolve the issue. As a temporary workaround, consider restricting network access to the MySQL Server to minimize the risk of exploitation.