In Percona XtraBackup (PXB) through 2.2.24 and 3.x through 8.0.27-19, a crafted filename on the local file system could trigger unexpected command shell execution of arbitrary commands.
{ "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro", "binaries": [ { "binary_name": "percona-xtrabackup", "binary_version": "2.3.7-0ubuntu0.16.04.2+esm1" }, { "binary_name": "percona-xtrabackup-dbg", "binary_version": "2.3.7-0ubuntu0.16.04.2+esm1" }, { "binary_name": "percona-xtrabackup-dbgsym", "binary_version": "2.3.7-0ubuntu0.16.04.2+esm1" }, { "binary_name": "percona-xtrabackup-test", "binary_version": "2.3.7-0ubuntu0.16.04.2+esm1" }, { "binary_name": "percona-xtrabackup-test-dbgsym", "binary_version": "2.3.7-0ubuntu0.16.04.2+esm1" }, { "binary_name": "xtrabackup", "binary_version": "2.3.7-0ubuntu0.16.04.2+esm1" } ], "ubuntu_priority": "medium" }
{ "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro", "binaries": [ { "binary_name": "percona-xtrabackup", "binary_version": "2.4.9-0ubuntu2+esm1" }, { "binary_name": "percona-xtrabackup-dbg", "binary_version": "2.4.9-0ubuntu2+esm1" }, { "binary_name": "percona-xtrabackup-test", "binary_version": "2.4.9-0ubuntu2+esm1" }, { "binary_name": "xtrabackup", "binary_version": "2.4.9-0ubuntu2+esm1" } ], "ubuntu_priority": "medium" }