In Percona XtraBackup (PXB) through 2.2.24 and 3.x through 8.0.27-19, a crafted filename on the local file system could trigger unexpected command shell execution of arbitrary commands.
{ "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "2.3.7-0ubuntu0.16.04.2+esm1", "binary_name": "percona-xtrabackup" }, { "binary_version": "2.3.7-0ubuntu0.16.04.2+esm1", "binary_name": "percona-xtrabackup-dbg" }, { "binary_version": "2.3.7-0ubuntu0.16.04.2+esm1", "binary_name": "percona-xtrabackup-dbgsym" }, { "binary_version": "2.3.7-0ubuntu0.16.04.2+esm1", "binary_name": "percona-xtrabackup-test" }, { "binary_version": "2.3.7-0ubuntu0.16.04.2+esm1", "binary_name": "percona-xtrabackup-test-dbgsym" }, { "binary_version": "2.3.7-0ubuntu0.16.04.2+esm1", "binary_name": "xtrabackup" } ] }
{ "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "2.4.9-0ubuntu2+esm1", "binary_name": "percona-xtrabackup" }, { "binary_version": "2.4.9-0ubuntu2+esm1", "binary_name": "percona-xtrabackup-dbg" }, { "binary_version": "2.4.9-0ubuntu2+esm1", "binary_name": "percona-xtrabackup-test" }, { "binary_version": "2.4.9-0ubuntu2+esm1", "binary_name": "xtrabackup" } ] }