CVE-2020-13249: 
MariaDB Server vulnerability analysis and mitigation

CVE-2020-13249 affects MariaDB Connector/C versions before 3.1.8. The vulnerability exists in the libmariadb/mariadb_lib.c file where the content of an OK packet received from a server is not properly validated (NVD, CVE).

The vulnerability is located in the ma_read_ok_packet function within libmariadb/mariadb_lib.c. The issue stems from insufficient validation of OK packet contents received from the server, which could lead to buffer overflows. The fix involved adding proper bounds checking and sanity checks for client-supplied OK packet content (GitHub Commit).

While the specific impact is not explicitly detailed in the sources, improper validation of server packets could potentially lead to security issues such as buffer overflows or denial of service conditions when processing malformed responses from a MariaDB server (Red Hat).

The vulnerability requires an attacker to be in a position to manipulate server responses or control a malicious server that a vulnerable client connects to. It's worth noting that although the mariadb_lib.c code was originally based on MySQL code, this issue does not affect any MySQL components supported by Oracle (CVE).

The vulnerability was fixed in MariaDB Connector/C version 3.1.8. Users should upgrade to this version or later to address the issue. Multiple vendors have released security updates including Red Hat Enterprise Linux, Fedora, and OpenSUSE (Red Hat, OpenSUSE).