[MDEV-25318] mysql_install_db.sh wrong instructions on how to set root password leading to passwordless root account. Created: 2021-04-01 Updated: 2021-04-01 Resolved: 2021-04-01 |
|
| Status: | Closed |
| Project: | MariaDB Server |
| Component/s: | Scripts & Clients |
| Affects Version/s: | 10.2.37, 10.3.28 |
| Fix Version/s: | N/A |
| Type: | Bug | Priority: | Major |
| Reporter: | Vytautas Bertasius | Assignee: | Sergei Golubchik |
| Resolution: | Duplicate | Votes: | 0 |
| Labels: | None | ||
| Environment: |
Centos7 and other linux |
||
| Issue Links: |
|
||||||||
| Description |
|
During MariaDB 10.2 or 10.3 installation mysql_install_db.sh provides following instructions how to reset root password:
So even if user follows the provided instruction how to set root password, there is still unprotected root user and it is CRITICAL vulnerability. IMO it is an important and misleading message and must be fixed, by providing instructions that works as expected. |
| Comments |
| Comment by Vytautas Bertasius [ 2021-04-01 ] |
|
Many years ago MySQL was creating only two root users(root@localhost, root@hostname), e.g. And had the same recommendations how to change password during installation and it was correct at that time. But at some point it started to add more user(root@127.0.0.1, root@::1,), e,g.: https://github.com/MariaDB/server/blob/10.3/scripts/mysql_system_tables_data.sql But recommendations on how to set root password during installation remained the same(https://github.com/MariaDB/server/blob/10.3/scripts/mysql_install_db.sh). And now it is misleading and dangerous. My suggestion is to remove recomendation set root password using these commands: |
| Comment by Sergei Golubchik [ 2021-04-01 ] |
|
Oh. Sorry. Following your email I've created an |