CVE-2020-14790: 
MySQL vulnerability analysis and mitigation

CVE-2020-14790 is a vulnerability in Oracle MySQL Server (component: Server: PS) affecting versions 5.7.31 and prior, and 8.0.21 and prior. The vulnerability was discovered by Yi Ren of Alibaba and was disclosed in Oracle's October 2020 Critical Patch Update (Oracle CPU).

This is a network-accessible vulnerability that requires high privileges to exploit but is considered easily exploitable. It has a CVSS 3.1 Base Score of 4.9 (Medium) with the following vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H. The vulnerability affects the MySQL Server component specifically in the PS (Performance Schema) subsystem (NVD).

Successful exploitation of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash, leading to a complete Denial of Service (DoS) of MySQL Server. The vulnerability only impacts availability, with no direct effects on confidentiality or integrity (NetApp Advisory).

The vulnerability is considered easily exploitable by an attacker with high privileges who has network access via multiple protocols. The attack requires no user interaction, though it does require the attacker to have high-level privileges to execute (Oracle CPU).

Oracle has released patches to address this vulnerability in MySQL versions 5.7.32 and 8.0.22. Users are strongly recommended to update to these versions or later. Multiple vendors have also released fixes, including Ubuntu with MySQL 8.0.22-0ubuntu0.20.04.2 for 20.04 LTS and MySQL 5.7.32-0ubuntu0.18.04.1 for 18.04 LTS (Ubuntu Notice).