Hi Josh, looked further into these issues. A, wrt http://bugs.mysql.com/bug.php?id=32167 You are right, that CVE-2008-2079 was originally assigned to: http://bugs.mysql.com/bug.php?id=32167 On "[6 May 2008 11:16] Sergei Golubchik" states: please, note in the manual that it's CVE-2008-2079 But last comment on this bug mentions: [12 Nov 4:50] Paul DuBois Noted in 5.1.41, 5.5.0, 6.0.14 changelogs. Additional corrections were made for the symlink-related privilege problem originally addressed in MySQL 5.1.24. The original fix did not correctly handle the data directory path name if it contained symlinked directories in its path, and the check was made only at table-creation time, not at table-opening time later. Also MySQL-5.1.41 news file now contains: Important Change: Security Fix: Additional corrections were made for the symlink-related privilege problem originally addressed in MySQL 5.1.24. The original fix did not correctly handle the data directory path name if it contained symlinked directories in its path, and the check was made only at table-creation time, not at table-opening time later. (Bug#32167, CVE-2008-2079)" Consequence: =========== So I think we will need a new CVE id as incomplete fix for CVE-2009-2079. Relevant patch is here (2845 Georgi Kodinov 2009-11-03) http://lists.mysql.com/commits/89940 Cc-ed MySQL security team to confirm this assumption. B, wrt to http://bugs.mysql.com/bug.php?id=39277 This is potential security issue, but the proposed patch didn't made it neither into 5.0.88, nor into 5.1.41 releases. In fact it was committed only to 6.0.9-alpha release ("Pushed into 6.0.9-alpha" comment from that bug). So we will need to wait a little bit for patch "stabilization". Conclusion - so two CVE ids are needed: --------------------------------------- 1, One for incomplete fix for CVE-2009-2079 issue) -- "and the check was made only at table-creation time, not at table-opening time later" http://bugs.mysql.com/bug.php?id=32167 http://lists.mysql.com/commits/89940 2, The second one for the "MySQL clients linked against OpenSSL did not check server certificates presented by a server linked against yaSSL" issue http://bugs.mysql.com/bug.php?id=47320 Sergei, please confirm / disprove the above. Thanks && Regards, Jan.