In Percona XtraBackup (PXB) through 2.2.24 and 3.x through 8.0.27-19, a crafted filename on the local file system could trigger unexpected command shell execution of arbitrary commands.
{ "binaries": [ { "binary_name": "percona-xtrabackup", "binary_version": "2.3.7-0ubuntu0.16.04.2+esm1" }, { "binary_name": "percona-xtrabackup-test", "binary_version": "2.3.7-0ubuntu0.16.04.2+esm1" }, { "binary_name": "xtrabackup", "binary_version": "2.3.7-0ubuntu0.16.04.2+esm1" } ], "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro" }
{ "binaries": [ { "binary_name": "percona-xtrabackup", "binary_version": "2.4.9-0ubuntu2+esm1" }, { "binary_name": "percona-xtrabackup-test", "binary_version": "2.4.9-0ubuntu2+esm1" }, { "binary_name": "xtrabackup", "binary_version": "2.4.9-0ubuntu2+esm1" } ], "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro" }