Vulnerability-Lookup

RHSA-2023:6821

Vulnerability from csaf_redhat - Published: 2023-11-08 15:38 - Updated: 2026-08-04 06:26

Summary

Red Hat Security Advisory: mariadb:10.5 security update

Severity

Important

Notes

Topic: An update for the mariadb:10.5 module is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Telecommunications Update Service, and Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL. Security Fix(es): * mariadb: node crashes with Transport endpoint is not connected mysqld got signal 6 (CVE-2023-5157) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2021-2154

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 5.7.33 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

4.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Affected products

Fixed 189 products

Product	Version	Remediation
Unresolved product id: AppStream-8.4.0.Z.AUS:Judy-0:1.0.5-18.module+el8.4.0+9031+9abc7af9.src::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.AUS:Judy-0:1.0.5-18.module+el8.4.0+9031+9abc7af9.x86_64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.AUS:Judy-debuginfo-0:1.0.5-18.module+el8.4.0+9031+9abc7af9.x86_64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.AUS:Judy-debugsource-0:1.0.5-18.module+el8.4.0+9031+9abc7af9.x86_64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.AUS:galera-0:26.4.14-1.module+el8.4.0+20291+fd32d29c.src::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.AUS:galera-0:26.4.14-1.module+el8.4.0+20291+fd32d29c.x86_64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.AUS:galera-debuginfo-0:26.4.14-1.module+el8.4.0+20291+fd32d29c.x86_64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.AUS:galera-debugsource-0:26.4.14-1.module+el8.4.0+20291+fd32d29c.x86_64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.AUS:mariadb-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.src::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.AUS:mariadb-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.x86_64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.AUS:mariadb-backup-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.x86_64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.AUS:mariadb-backup-debuginfo-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.x86_64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.AUS:mariadb-common-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.x86_64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.AUS:mariadb-debuginfo-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.x86_64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.AUS:mariadb-debugsource-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.x86_64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.AUS:mariadb-devel-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.x86_64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.AUS:mariadb-embedded-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.x86_64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.AUS:mariadb-embedded-debuginfo-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.x86_64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.AUS:mariadb-embedded-devel-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.x86_64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.AUS:mariadb-errmsg-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.x86_64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.AUS:mariadb-gssapi-server-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.x86_64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.AUS:mariadb-gssapi-server-debuginfo-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.x86_64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.AUS:mariadb-oqgraph-engine-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.x86_64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.AUS:mariadb-oqgraph-engine-debuginfo-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.x86_64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.AUS:mariadb-pam-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.x86_64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.AUS:mariadb-pam-debuginfo-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.x86_64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.AUS:mariadb-server-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.x86_64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.AUS:mariadb-server-debuginfo-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.x86_64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.AUS:mariadb-server-galera-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.x86_64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.AUS:mariadb-server-utils-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.x86_64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.AUS:mariadb-server-utils-debuginfo-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.x86_64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.AUS:mariadb-test-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.x86_64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.AUS:mariadb-test-debuginfo-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.x86_64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:Judy-0:1.0.5-18.module+el8.4.0+9031+9abc7af9.aarch64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:Judy-0:1.0.5-18.module+el8.4.0+9031+9abc7af9.ppc64le::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:Judy-0:1.0.5-18.module+el8.4.0+9031+9abc7af9.s390x::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:Judy-0:1.0.5-18.module+el8.4.0+9031+9abc7af9.src::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:Judy-0:1.0.5-18.module+el8.4.0+9031+9abc7af9.x86_64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:Judy-debuginfo-0:1.0.5-18.module+el8.4.0+9031+9abc7af9.aarch64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:Judy-debuginfo-0:1.0.5-18.module+el8.4.0+9031+9abc7af9.ppc64le::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:Judy-debuginfo-0:1.0.5-18.module+el8.4.0+9031+9abc7af9.s390x::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:Judy-debuginfo-0:1.0.5-18.module+el8.4.0+9031+9abc7af9.x86_64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:Judy-debugsource-0:1.0.5-18.module+el8.4.0+9031+9abc7af9.aarch64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:Judy-debugsource-0:1.0.5-18.module+el8.4.0+9031+9abc7af9.ppc64le::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:Judy-debugsource-0:1.0.5-18.module+el8.4.0+9031+9abc7af9.s390x::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:Judy-debugsource-0:1.0.5-18.module+el8.4.0+9031+9abc7af9.x86_64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:galera-0:26.4.14-1.module+el8.4.0+20291+fd32d29c.aarch64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:galera-0:26.4.14-1.module+el8.4.0+20291+fd32d29c.ppc64le::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:galera-0:26.4.14-1.module+el8.4.0+20291+fd32d29c.s390x::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:galera-0:26.4.14-1.module+el8.4.0+20291+fd32d29c.src::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:galera-0:26.4.14-1.module+el8.4.0+20291+fd32d29c.x86_64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:galera-debuginfo-0:26.4.14-1.module+el8.4.0+20291+fd32d29c.aarch64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:galera-debuginfo-0:26.4.14-1.module+el8.4.0+20291+fd32d29c.ppc64le::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:galera-debuginfo-0:26.4.14-1.module+el8.4.0+20291+fd32d29c.s390x::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:galera-debuginfo-0:26.4.14-1.module+el8.4.0+20291+fd32d29c.x86_64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:galera-debugsource-0:26.4.14-1.module+el8.4.0+20291+fd32d29c.aarch64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:galera-debugsource-0:26.4.14-1.module+el8.4.0+20291+fd32d29c.ppc64le::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:galera-debugsource-0:26.4.14-1.module+el8.4.0+20291+fd32d29c.s390x::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:galera-debugsource-0:26.4.14-1.module+el8.4.0+20291+fd32d29c.x86_64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.aarch64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.ppc64le::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.s390x::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.src::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.x86_64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-backup-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.aarch64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-backup-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.ppc64le::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-backup-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.s390x::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-backup-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.x86_64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-backup-debuginfo-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.aarch64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-backup-debuginfo-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.ppc64le::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-backup-debuginfo-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.s390x::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-backup-debuginfo-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.x86_64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-common-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.aarch64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-common-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.ppc64le::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-common-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.s390x::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-common-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.x86_64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-debuginfo-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.aarch64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-debuginfo-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.ppc64le::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-debuginfo-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.s390x::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-debuginfo-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.x86_64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-debugsource-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.aarch64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-debugsource-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.ppc64le::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-debugsource-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.s390x::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-debugsource-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.x86_64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-devel-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.aarch64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-devel-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.ppc64le::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-devel-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.s390x::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-devel-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.x86_64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-embedded-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.aarch64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-embedded-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.ppc64le::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-embedded-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.s390x::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-embedded-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.x86_64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-embedded-debuginfo-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.aarch64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-embedded-debuginfo-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.ppc64le::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-embedded-debuginfo-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.s390x::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-embedded-debuginfo-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.x86_64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-embedded-devel-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.aarch64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-embedded-devel-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.ppc64le::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-embedded-devel-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.s390x::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-embedded-devel-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.x86_64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-errmsg-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.aarch64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-errmsg-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.ppc64le::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-errmsg-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.s390x::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-errmsg-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.x86_64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-gssapi-server-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.aarch64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-gssapi-server-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.ppc64le::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-gssapi-server-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.s390x::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-gssapi-server-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.x86_64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-gssapi-server-debuginfo-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.aarch64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-gssapi-server-debuginfo-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.ppc64le::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-gssapi-server-debuginfo-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.s390x::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-gssapi-server-debuginfo-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.x86_64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-oqgraph-engine-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.aarch64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-oqgraph-engine-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.ppc64le::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-oqgraph-engine-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.s390x::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-oqgraph-engine-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.x86_64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-oqgraph-engine-debuginfo-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.aarch64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-oqgraph-engine-debuginfo-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.ppc64le::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-oqgraph-engine-debuginfo-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.s390x::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-oqgraph-engine-debuginfo-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.x86_64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-pam-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.aarch64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-pam-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.ppc64le::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-pam-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.s390x::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-pam-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.x86_64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-pam-debuginfo-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.aarch64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-pam-debuginfo-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.ppc64le::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-pam-debuginfo-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.s390x::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-pam-debuginfo-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.x86_64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-server-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.aarch64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-server-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.ppc64le::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-server-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.s390x::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-server-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.x86_64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-server-debuginfo-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.aarch64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-server-debuginfo-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.ppc64le::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-server-debuginfo-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.s390x::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-server-debuginfo-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.x86_64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-server-galera-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.aarch64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-server-galera-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.ppc64le::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-server-galera-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.s390x::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-server-galera-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.x86_64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-server-utils-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.aarch64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-server-utils-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.ppc64le::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-server-utils-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.s390x::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-server-utils-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.x86_64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-server-utils-debuginfo-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.aarch64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-server-utils-debuginfo-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.ppc64le::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-server-utils-debuginfo-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.s390x::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-server-utils-debuginfo-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.x86_64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-test-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.aarch64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-test-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.ppc64le::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-test-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.s390x::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-test-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.x86_64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-test-debuginfo-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.aarch64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-test-debuginfo-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.ppc64le::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-test-debuginfo-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.s390x::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.E4S:mariadb-test-debuginfo-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.x86_64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.TUS:Judy-0:1.0.5-18.module+el8.4.0+9031+9abc7af9.src::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.TUS:Judy-0:1.0.5-18.module+el8.4.0+9031+9abc7af9.x86_64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.TUS:Judy-debuginfo-0:1.0.5-18.module+el8.4.0+9031+9abc7af9.x86_64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.TUS:Judy-debugsource-0:1.0.5-18.module+el8.4.0+9031+9abc7af9.x86_64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.TUS:galera-0:26.4.14-1.module+el8.4.0+20291+fd32d29c.src::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.TUS:galera-0:26.4.14-1.module+el8.4.0+20291+fd32d29c.x86_64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.TUS:galera-debuginfo-0:26.4.14-1.module+el8.4.0+20291+fd32d29c.x86_64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.TUS:galera-debugsource-0:26.4.14-1.module+el8.4.0+20291+fd32d29c.x86_64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.TUS:mariadb-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.src::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.TUS:mariadb-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.x86_64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.TUS:mariadb-backup-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.x86_64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.TUS:mariadb-backup-debuginfo-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.x86_64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.TUS:mariadb-common-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.x86_64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.TUS:mariadb-debuginfo-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.x86_64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.TUS:mariadb-debugsource-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.x86_64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.TUS:mariadb-devel-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.x86_64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.TUS:mariadb-embedded-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.x86_64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.TUS:mariadb-embedded-debuginfo-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.x86_64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.TUS:mariadb-embedded-devel-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.x86_64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.TUS:mariadb-errmsg-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.x86_64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.TUS:mariadb-gssapi-server-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.x86_64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.TUS:mariadb-gssapi-server-debuginfo-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.x86_64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.TUS:mariadb-oqgraph-engine-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.x86_64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.TUS:mariadb-oqgraph-engine-debuginfo-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.x86_64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.TUS:mariadb-pam-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.x86_64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.TUS:mariadb-pam-debuginfo-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.x86_64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.TUS:mariadb-server-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.x86_64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.TUS:mariadb-server-debuginfo-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.x86_64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.TUS:mariadb-server-galera-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.x86_64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.TUS:mariadb-server-utils-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.x86_64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.TUS:mariadb-server-utils-debuginfo-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.x86_64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.TUS:mariadb-test-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.x86_64::mariadb:10.5	—	Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.TUS:mariadb-test-debuginfo-3:10.5.22-1.module+el8.4.0+20291+fd32d29c.x86_64::mariadb:10.5	—	Vendor Fix fix

Threats

Impact Moderate

CVE-2021-2166

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 5.7.33 and prior and 8.0.23 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

4.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Affected products

Fixed 189 products, the same list as for CVE-2021-2154

Threats

Impact Moderate

CVE-2021-2372

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.34 and prior and 8.0.25 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).

4.4 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

Affected products

Fixed 189 products, the same list as for CVE-2021-2154

Threats

Impact Moderate

CVE-2021-2389

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.34 and prior and 8.0.25 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H).

5.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Fixed 189 products, the same list as for CVE-2021-2154

Threats

Impact Moderate

CVE-2021-35604

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.35 and prior and 8.0.26 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.1 Base Score 5.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H).

5.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H

Affected products

Fixed 189 products, the same list as for CVE-2021-2154

Threats

Impact Moderate

CVE-2021-46657

get_sort_by_table in MariaDB before 10.6.2 allows an application crash via certain subquery uses of ORDER BY.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-20 - Improper Input Validation

Affected products

Fixed 189 products, the same list as for CVE-2021-2154

Threats

Impact Low

CVE-2021-46658

save_window_function_values in MariaDB before 10.6.3 allows an application crash because of incorrect handling of with_window_func=true for a subquery.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-20 - Improper Input Validation

Affected products

Fixed 189 products, the same list as for CVE-2021-2154

Threats

Impact Low

CVE-2021-46659

MariaDB before 10.7.2 allows an application crash because it does not recognize that SELECT_LEX::nest_level is local to each VIEW.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-20 - Improper Input Validation

Affected products

Fixed 189 products, the same list as for CVE-2021-2154

Threats

Impact Low

CVE-2021-46661

MariaDB through 10.5.9 allows an application crash in find_field_in_tables and find_order_in_list via an unused common table expression (CTE).

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-20 - Improper Input Validation

Affected products

Fixed 189 products, the same list as for CVE-2021-2154

Threats

Impact Low

CVE-2021-46662

MariaDB through 10.5.9 allows a set_var.cc application crash via certain uses of an UPDATE statement in conjunction with a nested subquery.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-20 - Improper Input Validation

Affected products

Fixed 189 products, the same list as for CVE-2021-2154

Threats

Impact Low

CVE-2021-46663

MariaDB through 10.5.13 allows a ha_maria::extra application crash via certain SELECT statements.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-20 - Improper Input Validation

Affected products

Fixed 189 products, the same list as for CVE-2021-2154

Threats

Impact Low

CVE-2021-46664

MariaDB through 10.5.9 allows an application crash in sub_select_postjoin_aggr for a NULL value of aggr.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-476 - NULL Pointer Dereference

Affected products

Fixed 189 products, the same list as for CVE-2021-2154

Threats

Impact Low

CVE-2021-46665

MariaDB through 10.5.9 allows a sql_parse.cc application crash because of incorrect used_tables expectations.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-20 - Improper Input Validation

Affected products

Fixed 189 products, the same list as for CVE-2021-2154

Threats

Impact Low

CVE-2021-46666

MariaDB before 10.6.2 allows an application crash because of mishandling of a pushdown from a HAVING clause to a WHERE clause.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-20 - Improper Input Validation

Affected products

Fixed 189 products, the same list as for CVE-2021-2154

Threats

Impact Low

CVE-2021-46667

An integer overflow vulnerability was found in MariaDB, where an invalid size of ref_pointer_array is allocated. This issue results in a denial of service.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-190 - Integer Overflow or Wraparound

Affected products

Fixed 189 products, the same list as for CVE-2021-2154

Threats

Impact Moderate

CVE-2021-46668

MariaDB through 10.5.9 allows an application crash via certain long SELECT DISTINCT statements that improperly interact with storage-engine resource limitations for temporary data structures.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-400 - Uncontrolled Resource Consumption

Affected products

Fixed 189 products, the same list as for CVE-2021-2154

Threats

Impact Low

CVE-2021-46669

A use-after-free vulnerability was found in MariaDB. This flaw allows attackers to trigger a convert_const_to_int() use-after-free when the BIGINT data type is used, resulting in a denial of service.

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-416 - Use After Free

Affected products

Fixed 189 products, the same list as for CVE-2021-2154

Threats

Impact Moderate

CVE-2022-21451

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.37 and prior and 8.0.28 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).

4.4 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

Affected products

Fixed 189 products, the same list as for CVE-2021-2154

Threats

Impact Moderate

CVE-2022-21595

Vulnerability in the MySQL Server product of Oracle MySQL (component: C API). Supported versions that are affected are 5.7.36 and prior and 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).

4.4 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

Affected products

Fixed 189 products, the same list as for CVE-2021-2154

Threats

Impact Moderate

CVE-2022-24048

MariaDB CONNECT Storage Engine Stack-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MariaDB. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of SQL queries. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the service account. Was ZDI-CAN-16191.

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Affected products

Fixed 189 products, the same list as for CVE-2021-2154

Threats

Impact Moderate

CVE-2022-24050

MariaDB CONNECT Storage Engine Use-After-Free Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MariaDB. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of SQL queries. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the service account. Was ZDI-CAN-16207.

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-1173 - Improper Use of Validation Framework

Affected products

Fixed 189 products, the same list as for CVE-2021-2154

Threats

Impact Moderate

CVE-2022-24051

MariaDB CONNECT Storage Engine Format String Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MariaDB. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of SQL queries. The issue results from the lack of proper validation of a user-supplied string before using it as a format specifier. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the service account. Was ZDI-CAN-16193.

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-134 - Use of Externally-Controlled Format String

Affected products

Fixed 189 products, the same list as for CVE-2021-2154

Threats

Impact Moderate

CVE-2022-24052

A flaw was found in MariaDB. Lack of input validation leads to a heap buffer overflow. This flaw allows an authenticated, local attacker with at least a low level of privileges to submit a crafted SQL query to MariaDB and escalate their privileges to the level of the MariaDB service user, running arbitrary code.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-122 - Heap-based Buffer Overflow

Affected products

Fixed 189 products, the same list as for CVE-2021-2154

Threats

Impact Moderate

CVE-2022-27376

A use-after-free flaw was found in Maria DB. The MariaDB Server contains a use-after-free in the component, Item_args::walk_arg, which is exploited via specially crafted SQL statements, affecting availability.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-617 - Reachable Assertion

Affected products

Fixed 189 products, the same list as for CVE-2021-2154

Threats

Impact Moderate

CVE-2022-27377

A flaw was found in the MariaDB Server, where it contains a use-after-free in the component, Item_func_in::cleanup(). This issue is exploited via specially crafted SQL statements, affecting availability.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-416 - Use After Free

Affected products

Fixed 189 products, the same list as for CVE-2021-2154

Threats

Impact Moderate

CVE-2022-27378

A flaw was found in MariaDB. The component, Create_tmp_table::finalize, allows attackers to cause a denial of service (DoS) via specially crafted SQL statements, affecting availability.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Affected products

Fixed 189 products, the same list as for CVE-2021-2154

Threats

Impact Moderate

CVE-2022-27379

A flaw was found in MariaDB. The component, Arg_comparator::compare_real_fixed, allows attackers to cause a denial of service (DoS) via specially crafted SQL statements, affecting availability.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Affected products

Fixed 189 products, the same list as for CVE-2021-2154

Threats

Impact Moderate

CVE-2022-27380

A flaw was found in MariaDB. The component, my_decimal::operator=, allows attackers to cause a denial of service (DoS) via specially crafted SQL statements, affecting availability.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Affected products

Fixed 189 products, the same list as for CVE-2021-2154

Threats

Impact Moderate

CVE-2022-27381

A flaw was found in MariaDB. The component, Field::set_default, allows attackers to cause a denial of service (DoS) via specially crafted SQL statements, affecting availability.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Affected products

Fixed 189 products, the same list as for CVE-2021-2154

Threats

Impact Moderate

CVE-2022-27382

A flaw was found in MariaDB. A segmentation fault via the component, Item_field::used_tables/update_depend_map_for_order, impacts availability.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-617 - Reachable Assertion

Affected products

Fixed 189 products, the same list as for CVE-2021-2154

Threats

Impact Moderate

CVE-2022-27383

A flaw was found in the MariaDB Server. A use-after-free in the component, my_strcasecmp_8bit, can be exploited via specially crafted SQL statements, impacting availability.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-416 - Use After Free

Affected products

Fixed 189 products, the same list as for CVE-2021-2154

Threats

Impact Moderate

CVE-2022-27384

A flaw was found in MariaDB. An issue in the component, Item_subselect::init_expr_cache_tracker of the MariaDB Server, allows attackers to cause a denial of service (DoS) via specially crafted SQL statements, impacting availability.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Affected products

Fixed 189 products, the same list as for CVE-2021-2154

Threats

Impact Moderate

CVE-2022-27385

A flaw was found in MariaDB. An issue in the component, Used_tables_and_const_cache::used_tables_and_const_cache_join, of the MariaDB Server v10.7 allows attackers to cause a denial of service (DoS) via specially crafted SQL statements, impacting availability.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Affected products

Fixed 189 products, the same list as for CVE-2021-2154

Threats

Impact Moderate

CVE-2022-27386

A flaw was found in the MariaDB Server. It contains a segmentation fault via the component, sql/sql_class.cc, impacting availability.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Affected products

Fixed 189 products, the same list as for CVE-2021-2154

Threats

Impact Moderate

CVE-2022-27387

A flaw was found in the MariaDB Server. It contains a global buffer overflow in the component, decimal_bin_size, which is exploited via specially crafted SQL statements, impacting availability.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Affected products

Fixed 189 products, the same list as for CVE-2021-2154

Threats

Impact Moderate

CVE-2022-27444

A flaw was found in the MariaDB Server. It contains a segmentation fault via the component, sql/item_subselect.cc, affecting availability.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Affected products

Fixed 189 products, the same list as for CVE-2021-2154

Threats

Impact Moderate

CVE-2022-27445

A flaw was found in the MariaDB Server. It contains a segmentation fault via the component, sql/sql_window.cc, impacting availability.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Fixed 189 products, the same list as for CVE-2021-2154

Threats

Impact Moderate

CVE-2022-27446

A flaw was found in the MariaDB Server. It contains a segmentation fault via the component, sql/item_cmpfunc.h, impacting availability.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-617 - Reachable Assertion

Affected products

Fixed 189 products, the same list as for CVE-2021-2154

Threats

Impact Moderate

CVE-2022-27447

A flaw was found in the MariaDB Server. It contains a use-after-free via the component,Binary_string::free_buffer() at /sql/sql_string.h, affecting availability.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-617 - Reachable Assertion

Affected products

Fixed 189 products, the same list as for CVE-2021-2154

Threats

Impact Moderate

CVE-2022-27448

An assertion failure was found in the MariaDB Server. This issue is via, 'node->pcur->rel_pos == BTR_PCUR_ON' at /row/row0mysql.cc, affecting availability.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-617 - Reachable Assertion

Affected products

Fixed 189 products, the same list as for CVE-2021-2154

Threats

Impact Moderate

CVE-2022-27449

A flaw was found in the MariaDB Server. It contains a segmentation fault via the component, sql/item_func.cc:148, affecting availability.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-617 - Reachable Assertion

Affected products

Fixed 189 products, the same list as for CVE-2021-2154

Threats

Impact Moderate

CVE-2022-27451

A flaw was found in the MariaDB Server. It contains a segmentation fault via the component, sql/field_conv.cc, affecting availability.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-1173 - Improper Use of Validation Framework

Affected products

Fixed 189 products, the same list as for CVE-2021-2154

Threats

Impact Moderate

CVE-2022-27452

A flaw was found in the MariaDB Server. It contains a segmentation fault via the component, sql/item_cmpfunc.cc, affecting availability.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-617 - Reachable Assertion

Affected products

Fixed 189 products, the same list as for CVE-2021-2154

Threats

Impact Moderate

CVE-2022-27455

A flaw was found in the MariaDB Server. It contains a use-after-free in the component, my_wildcmp_8bit_impl at /strings/ctype-simple.c, affecting availability.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-416 - Use After Free

Affected products

Fixed 189 products, the same list as for CVE-2021-2154

Threats

Impact Moderate

CVE-2022-27456

A flaw was found in the MariaDB Server. It contains a use-after-free in the component, VDec::VDec at /sql/sql_type.cc, affecting availability.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-617 - Reachable Assertion

Affected products

Fixed 189 products, the same list as for CVE-2021-2154

Threats

Impact Moderate

CVE-2022-27457

A flaw was found in the MariaDB Server. It contains a use-after-free in the component, my_mb_wc_latin1 at /strings/ctype-latin1.c, affecting availability.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-416 - Use After Free

Affected products

Fixed 189 products, the same list as for CVE-2021-2154

Threats

Impact Moderate

CVE-2022-27458

A flaw was found in the MariaDB Server. It contains a use-after-free in the component, Binary_string::free_buffer() at /sql/sql_string.h, affecting availability.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-617 - Reachable Assertion

Affected products

Fixed 189 products, the same list as for CVE-2021-2154

Threats

Impact Moderate

CVE-2022-31621

MariaDB Server before 10.7 is vulnerable to Denial of Service. In extra/mariabackup/ds_xbstream.cc, when an error occurs (stream_ctxt->dest_file == NULL) while executing the method xbstream_open, the held lock is not released correctly, which allows local users to trigger a denial of service due to the deadlock. Note: The vendor argues this is just an improper locking bug and not a vulnerability with adverse effects.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-667 - Improper Locking

Affected products

Fixed 189 products, the same list as for CVE-2021-2154

Threats

Impact Moderate

CVE-2022-31622

MariaDB Server before 10.7 is vulnerable to Denial of Service. In extra/mariabackup/ds_compress.cc, when an error occurs (pthread_create returns a nonzero value) while executing the method create_worker_threads, the held lock is not released correctly, which allows local users to trigger a denial of service due to the deadlock. Note: The vendor argues this is just an improper locking bug and not a vulnerability with adverse effects.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-404 - Improper Resource Shutdown or Release

Affected products

Fixed 189 products, the same list as for CVE-2021-2154

Threats

Impact Moderate

CVE-2022-31623

MariaDB Server before 10.7 is vulnerable to Denial of Service. In extra/mariabackup/ds_compress.cc, when an error occurs (i.e., going to the err label) while executing the method create_worker_threads, the held lock thd->ctrl_mutex is not released correctly, which allows local users to trigger a denial of service due to the deadlock. Note: The vendor argues this is just an improper locking bug and not a vulnerability with adverse effects.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-667 - Improper Locking

Affected products

Fixed 189 products, the same list as for CVE-2021-2154

Threats

Impact Moderate

CVE-2022-31624

MariaDB Server before 10.7 is vulnerable to Denial of Service. While executing the plugin/server_audit/server_audit.c method log_statement_ex, the held lock lock_bigbuffer is not released correctly, which allows local users to trigger a denial of service due to the deadlock.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-404 - Improper Resource Shutdown or Release

Affected products

Fixed 189 products, the same list as for CVE-2021-2154

Threats

Impact Moderate

CVE-2022-32081

MariaDB v10.4 to v10.7 was discovered to contain an use-after-poison in prepare_inplace_add_virtual at /storage/innobase/handler/handler0alter.cc.

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-229 - Improper Handling of Values

Affected products

Fixed 189 products, the same list as for CVE-2021-2154

Threats

Impact Moderate

CVE-2022-32082

MariaDB v10.5 to v10.7 was discovered to contain an assertion failure at table->get_ref_count() == 0 in dict0dict.cc.

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-617 - Reachable Assertion

Affected products

Fixed 189 products, the same list as for CVE-2021-2154

Threats

Impact Moderate

CVE-2022-32083

MariaDB v10.2 to v10.6.1 was discovered to contain a segmentation fault via the component Item_subselect::init_expr_cache_tracker.

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-229 - Improper Handling of Values

Affected products

Fixed 189 products, the same list as for CVE-2021-2154

Threats

Impact Moderate

CVE-2022-32084

MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component sub_select.

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-229 - Improper Handling of Values

Affected products

Fixed 189 products, the same list as for CVE-2021-2154

Threats

Impact Moderate

CVE-2022-32085

MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component Item_func_in::cleanup/Item::cleanup_processor.

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-229 - Improper Handling of Values

Affected products

Fixed 189 products, the same list as for CVE-2021-2154

Threats

Impact Moderate

CVE-2022-32086

MariaDB v10.4 to v10.8 was discovered to contain a segmentation fault via the component Item_field::fix_outer_field.

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-229 - Improper Handling of Values

Affected products

Fixed 189 products, the same list as for CVE-2021-2154

Threats

Impact Moderate

CVE-2022-32087

MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component Item_args::walk_args.

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-229 - Improper Handling of Values

Affected products

Fixed 189 products, the same list as for CVE-2021-2154

Threats

Impact Moderate

CVE-2022-32088

MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component Exec_time_tracker::get_loops/Filesort_tracker::report_use/filesort.

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-229 - Improper Handling of Values

Affected products

Fixed 189 products, the same list as for CVE-2021-2154

Threats

Impact Moderate

CVE-2022-32089

MariaDB v10.5 to v10.7 was discovered to contain a segmentation fault via the component st_select_lex_unit::exclude_level.

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-229 - Improper Handling of Values

Affected products

Fixed 189 products, the same list as for CVE-2021-2154

Threats

Impact Moderate

CVE-2022-32091

MariaDB v10.7 was discovered to contain an use-after-poison in in __interceptor_memset at /libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc.

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-229 - Improper Handling of Values

Affected products

Fixed 189 products, the same list as for CVE-2021-2154

Threats

Impact Moderate

CVE-2022-38791

In MariaDB before 10.9.2, compress_write in extra/mariabackup/ds_compress.cc does not release data_mutex upon a stream write failure, which allows local users to trigger a deadlock.

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-667 - Improper Locking

Affected products

Fixed 189 products, the same list as for CVE-2021-2154

Threats

Impact Moderate

CVE-2022-47015

MariaDB Server before 10.3.34 thru 10.9.3 is vulnerable to Denial of Service. It is possible for function spider_db_mbase::print_warnings to dereference a null pointer.

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-476 - NULL Pointer Dereference

Affected products

Fixed 189 products, the same list as for CVE-2021-2154

Threats

Impact Moderate

CVE-2023-5157

A vulnerability was found in MariaDB. An OpenVAS port scan on ports 3306 and 4567 allows a malicious remote client to cause a denial of service.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-400 - Uncontrolled Resource Consumption

Affected products

Fixed 189 products, the same list as for CVE-2021-2154

Threats

Impact Important

References

262 references

URL	Category
https://access.redhat.com/errata/RHSA-2023:6821	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=2240246	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2021-2154	self
https://bugzilla.redhat.com/show_bug.cgi?id=1951752	external
https://www.cve.org/CVERecord?id=CVE-2021-2154	external
https://nvd.nist.gov/vuln/detail/CVE-2021-2154	external
https://www.oracle.com/security-alerts/cpuapr2021…	external
https://access.redhat.com/security/cve/CVE-2021-2166	self
https://bugzilla.redhat.com/show_bug.cgi?id=1951755	external
https://www.cve.org/CVERecord?id=CVE-2021-2166	external
https://nvd.nist.gov/vuln/detail/CVE-2021-2166	external
https://access.redhat.com/security/cve/CVE-2021-2372	self
https://bugzilla.redhat.com/show_bug.cgi?id=1992303	external
https://www.cve.org/CVERecord?id=CVE-2021-2372	external
https://nvd.nist.gov/vuln/detail/CVE-2021-2372	external
https://access.redhat.com/security/cve/CVE-2021-2389	self
https://bugzilla.redhat.com/show_bug.cgi?id=1992309	external
https://www.cve.org/CVERecord?id=CVE-2021-2389	external
https://nvd.nist.gov/vuln/detail/CVE-2021-2389	external
https://access.redhat.com/security/cve/CVE-2021-35604	self
https://bugzilla.redhat.com/show_bug.cgi?id=2016101	external
https://www.cve.org/CVERecord?id=CVE-2021-35604	external
https://nvd.nist.gov/vuln/detail/CVE-2021-35604	external
https://access.redhat.com/security/cve/CVE-2021-46657	self
https://bugzilla.redhat.com/show_bug.cgi?id=2049305	external
https://www.cve.org/CVERecord?id=CVE-2021-46657	external
https://nvd.nist.gov/vuln/detail/CVE-2021-46657	external
https://access.redhat.com/security/cve/CVE-2021-46658	self
https://bugzilla.redhat.com/show_bug.cgi?id=2049294	external
https://www.cve.org/CVERecord?id=CVE-2021-46658	external
https://nvd.nist.gov/vuln/detail/CVE-2021-46658	external
https://access.redhat.com/security/cve/CVE-2021-46659	self
https://bugzilla.redhat.com/show_bug.cgi?id=2049302	external
https://www.cve.org/CVERecord?id=CVE-2021-46659	external
https://nvd.nist.gov/vuln/detail/CVE-2021-46659	external
https://access.redhat.com/security/cve/CVE-2021-46661	self
https://bugzilla.redhat.com/show_bug.cgi?id=2050017	external
https://www.cve.org/CVERecord?id=CVE-2021-46661	external
https://nvd.nist.gov/vuln/detail/CVE-2021-46661	external
https://access.redhat.com/security/cve/CVE-2021-46662	self
https://bugzilla.redhat.com/show_bug.cgi?id=2050019	external
https://www.cve.org/CVERecord?id=CVE-2021-46662	external
https://nvd.nist.gov/vuln/detail/CVE-2021-46662	external
https://access.redhat.com/security/cve/CVE-2021-46663	self
https://bugzilla.redhat.com/show_bug.cgi?id=2050022	external
https://www.cve.org/CVERecord?id=CVE-2021-46663	external
https://nvd.nist.gov/vuln/detail/CVE-2021-46663	external
https://access.redhat.com/security/cve/CVE-2021-46664	self
https://bugzilla.redhat.com/show_bug.cgi?id=2050024	external
https://www.cve.org/CVERecord?id=CVE-2021-46664	external
https://nvd.nist.gov/vuln/detail/CVE-2021-46664	external
https://access.redhat.com/security/cve/CVE-2021-46665	self
https://bugzilla.redhat.com/show_bug.cgi?id=2050026	external
https://www.cve.org/CVERecord?id=CVE-2021-46665	external
https://nvd.nist.gov/vuln/detail/CVE-2021-46665	external
https://access.redhat.com/security/cve/CVE-2021-46666	self
https://bugzilla.redhat.com/show_bug.cgi?id=2050028	external
https://www.cve.org/CVERecord?id=CVE-2021-46666	external
https://nvd.nist.gov/vuln/detail/CVE-2021-46666	external
https://access.redhat.com/security/cve/CVE-2021-46667	self
https://bugzilla.redhat.com/show_bug.cgi?id=2050030	external
https://www.cve.org/CVERecord?id=CVE-2021-46667	external
https://nvd.nist.gov/vuln/detail/CVE-2021-46667	external
https://access.redhat.com/security/cve/CVE-2021-46668	self
https://bugzilla.redhat.com/show_bug.cgi?id=2050032	external
https://www.cve.org/CVERecord?id=CVE-2021-46668	external
https://nvd.nist.gov/vuln/detail/CVE-2021-46668	external
https://access.redhat.com/security/cve/CVE-2021-46669	self
https://bugzilla.redhat.com/show_bug.cgi?id=2050034	external
https://www.cve.org/CVERecord?id=CVE-2021-46669	external
https://nvd.nist.gov/vuln/detail/CVE-2021-46669	external
https://access.redhat.com/security/cve/CVE-2022-21451	self
https://bugzilla.redhat.com/show_bug.cgi?id=2082651	external
https://www.cve.org/CVERecord?id=CVE-2022-21451	external
https://nvd.nist.gov/vuln/detail/CVE-2022-21451	external
https://access.redhat.com/security/cve/CVE-2022-21595	self
https://bugzilla.redhat.com/show_bug.cgi?id=2142862	external
https://www.cve.org/CVERecord?id=CVE-2022-21595	external
https://nvd.nist.gov/vuln/detail/CVE-2022-21595	external
https://access.redhat.com/security/cve/CVE-2022-24048	self
https://bugzilla.redhat.com/show_bug.cgi?id=2068234	external
https://www.cve.org/CVERecord?id=CVE-2022-24048	external
https://nvd.nist.gov/vuln/detail/CVE-2022-24048	external
https://access.redhat.com/security/cve/CVE-2022-24050	self
https://bugzilla.redhat.com/show_bug.cgi?id=2069833	external
https://www.cve.org/CVERecord?id=CVE-2022-24050	external
https://nvd.nist.gov/vuln/detail/CVE-2022-24050	external
https://access.redhat.com/security/cve/CVE-2022-24051	self
https://bugzilla.redhat.com/show_bug.cgi?id=2068233	external
https://www.cve.org/CVERecord?id=CVE-2022-24051	external
https://nvd.nist.gov/vuln/detail/CVE-2022-24051	external
https://access.redhat.com/security/cve/CVE-2022-24052	self
https://bugzilla.redhat.com/show_bug.cgi?id=2068211	external
https://www.cve.org/CVERecord?id=CVE-2022-24052	external
https://nvd.nist.gov/vuln/detail/CVE-2022-24052	external
https://mariadb.com/kb/en/security/	external
https://access.redhat.com/security/cve/CVE-2022-27376	self
https://bugzilla.redhat.com/show_bug.cgi?id=2074817	external
https://www.cve.org/CVERecord?id=CVE-2022-27376	external
https://nvd.nist.gov/vuln/detail/CVE-2022-27376	external
https://access.redhat.com/security/cve/CVE-2022-27377	self
https://bugzilla.redhat.com/show_bug.cgi?id=2074947	external
https://www.cve.org/CVERecord?id=CVE-2022-27377	external
https://nvd.nist.gov/vuln/detail/CVE-2022-27377	external
https://access.redhat.com/security/cve/CVE-2022-27378	self
https://bugzilla.redhat.com/show_bug.cgi?id=2074949	external
https://www.cve.org/CVERecord?id=CVE-2022-27378	external
https://nvd.nist.gov/vuln/detail/CVE-2022-27378	external
https://access.redhat.com/security/cve/CVE-2022-27379	self
https://bugzilla.redhat.com/show_bug.cgi?id=2074951	external
https://www.cve.org/CVERecord?id=CVE-2022-27379	external
https://nvd.nist.gov/vuln/detail/CVE-2022-27379	external
https://access.redhat.com/security/cve/CVE-2022-27380	self
https://bugzilla.redhat.com/show_bug.cgi?id=2074966	external
https://www.cve.org/CVERecord?id=CVE-2022-27380	external
https://nvd.nist.gov/vuln/detail/CVE-2022-27380	external
https://access.redhat.com/security/cve/CVE-2022-27381	self
https://bugzilla.redhat.com/show_bug.cgi?id=2074981	external
https://www.cve.org/CVERecord?id=CVE-2022-27381	external
https://nvd.nist.gov/vuln/detail/CVE-2022-27381	external
https://access.redhat.com/security/cve/CVE-2022-27382	self
https://bugzilla.redhat.com/show_bug.cgi?id=2074987	external
https://www.cve.org/CVERecord?id=CVE-2022-27382	external
https://nvd.nist.gov/vuln/detail/CVE-2022-27382	external
https://access.redhat.com/security/cve/CVE-2022-27383	self
https://bugzilla.redhat.com/show_bug.cgi?id=2074996	external
https://www.cve.org/CVERecord?id=CVE-2022-27383	external
https://nvd.nist.gov/vuln/detail/CVE-2022-27383	external
https://access.redhat.com/security/cve/CVE-2022-27384	self
https://bugzilla.redhat.com/show_bug.cgi?id=2074999	external
https://www.cve.org/CVERecord?id=CVE-2022-27384	external
https://nvd.nist.gov/vuln/detail/CVE-2022-27384	external
https://access.redhat.com/security/cve/CVE-2022-27385	self
https://bugzilla.redhat.com/show_bug.cgi?id=2075001	external
https://www.cve.org/CVERecord?id=CVE-2022-27385	external
https://nvd.nist.gov/vuln/detail/CVE-2022-27385	external
https://access.redhat.com/security/cve/CVE-2022-27386	self
https://bugzilla.redhat.com/show_bug.cgi?id=2075005	external
https://www.cve.org/CVERecord?id=CVE-2022-27386	external
https://nvd.nist.gov/vuln/detail/CVE-2022-27386	external
https://access.redhat.com/security/cve/CVE-2022-27387	self
https://bugzilla.redhat.com/show_bug.cgi?id=2075006	external
https://www.cve.org/CVERecord?id=CVE-2022-27387	external
https://nvd.nist.gov/vuln/detail/CVE-2022-27387	external
https://access.redhat.com/security/cve/CVE-2022-27444	self
https://bugzilla.redhat.com/show_bug.cgi?id=2075696	external
https://www.cve.org/CVERecord?id=CVE-2022-27444	external
https://nvd.nist.gov/vuln/detail/CVE-2022-27444	external
https://access.redhat.com/security/cve/CVE-2022-27445	self
https://bugzilla.redhat.com/show_bug.cgi?id=2075691	external
https://www.cve.org/CVERecord?id=CVE-2022-27445	external
https://nvd.nist.gov/vuln/detail/CVE-2022-27445	external
https://access.redhat.com/security/cve/CVE-2022-27446	self
https://bugzilla.redhat.com/show_bug.cgi?id=2075692	external
https://www.cve.org/CVERecord?id=CVE-2022-27446	external
https://nvd.nist.gov/vuln/detail/CVE-2022-27446	external
https://access.redhat.com/security/cve/CVE-2022-27447	self
https://bugzilla.redhat.com/show_bug.cgi?id=2075693	external
https://www.cve.org/CVERecord?id=CVE-2022-27447	external
https://nvd.nist.gov/vuln/detail/CVE-2022-27447	external
https://access.redhat.com/security/cve/CVE-2022-27448	self
https://bugzilla.redhat.com/show_bug.cgi?id=2075694	external
https://www.cve.org/CVERecord?id=CVE-2022-27448	external
https://nvd.nist.gov/vuln/detail/CVE-2022-27448	external
https://access.redhat.com/security/cve/CVE-2022-27449	self
https://bugzilla.redhat.com/show_bug.cgi?id=2075695	external
https://www.cve.org/CVERecord?id=CVE-2022-27449	external
https://nvd.nist.gov/vuln/detail/CVE-2022-27449	external
https://access.redhat.com/security/cve/CVE-2022-27451	self
https://bugzilla.redhat.com/show_bug.cgi?id=2076144	external
https://www.cve.org/CVERecord?id=CVE-2022-27451	external
https://nvd.nist.gov/vuln/detail/CVE-2022-27451	external
https://access.redhat.com/security/cve/CVE-2022-27452	self
https://bugzilla.redhat.com/show_bug.cgi?id=2076145	external
https://www.cve.org/CVERecord?id=CVE-2022-27452	external
https://nvd.nist.gov/vuln/detail/CVE-2022-27452	external
https://access.redhat.com/security/cve/CVE-2022-27455	self
https://bugzilla.redhat.com/show_bug.cgi?id=2075701	external
https://www.cve.org/CVERecord?id=CVE-2022-27455	external
https://nvd.nist.gov/vuln/detail/CVE-2022-27455	external
https://access.redhat.com/security/cve/CVE-2022-27456	self
https://bugzilla.redhat.com/show_bug.cgi?id=2075697	external
https://www.cve.org/CVERecord?id=CVE-2022-27456	external
https://nvd.nist.gov/vuln/detail/CVE-2022-27456	external
https://access.redhat.com/security/cve/CVE-2022-27457	self
https://bugzilla.redhat.com/show_bug.cgi?id=2075699	external
https://www.cve.org/CVERecord?id=CVE-2022-27457	external
https://nvd.nist.gov/vuln/detail/CVE-2022-27457	external
https://access.redhat.com/security/cve/CVE-2022-27458	self
https://bugzilla.redhat.com/show_bug.cgi?id=2075700	external
https://www.cve.org/CVERecord?id=CVE-2022-27458	external
https://nvd.nist.gov/vuln/detail/CVE-2022-27458	external
https://access.redhat.com/security/cve/CVE-2022-31621	self
https://bugzilla.redhat.com/show_bug.cgi?id=2092353	external
https://www.cve.org/CVERecord?id=CVE-2022-31621	external
https://nvd.nist.gov/vuln/detail/CVE-2022-31621	external
https://access.redhat.com/security/cve/CVE-2022-31622	self
https://bugzilla.redhat.com/show_bug.cgi?id=2092354	external
https://www.cve.org/CVERecord?id=CVE-2022-31622	external
https://nvd.nist.gov/vuln/detail/CVE-2022-31622	external
https://access.redhat.com/security/cve/CVE-2022-31623	self
https://bugzilla.redhat.com/show_bug.cgi?id=2092360	external
https://www.cve.org/CVERecord?id=CVE-2022-31623	external
https://nvd.nist.gov/vuln/detail/CVE-2022-31623	external
https://access.redhat.com/security/cve/CVE-2022-31624	self
https://bugzilla.redhat.com/show_bug.cgi?id=2092362	external
https://www.cve.org/CVERecord?id=CVE-2022-31624	external
https://nvd.nist.gov/vuln/detail/CVE-2022-31624	external
https://access.redhat.com/security/cve/CVE-2022-32081	self
https://bugzilla.redhat.com/show_bug.cgi?id=2106028	external
https://www.cve.org/CVERecord?id=CVE-2022-32081	external
https://nvd.nist.gov/vuln/detail/CVE-2022-32081	external
https://access.redhat.com/security/cve/CVE-2022-32082	self
https://bugzilla.redhat.com/show_bug.cgi?id=2106030	external
https://www.cve.org/CVERecord?id=CVE-2022-32082	external
https://nvd.nist.gov/vuln/detail/CVE-2022-32082	external
https://access.redhat.com/security/cve/CVE-2022-32083	self
https://bugzilla.redhat.com/show_bug.cgi?id=2104425	external
https://www.cve.org/CVERecord?id=CVE-2022-32083	external
https://nvd.nist.gov/vuln/detail/CVE-2022-32083	external
https://access.redhat.com/security/cve/CVE-2022-32084	self
https://bugzilla.redhat.com/show_bug.cgi?id=2106034	external
https://www.cve.org/CVERecord?id=CVE-2022-32084	external
https://nvd.nist.gov/vuln/detail/CVE-2022-32084	external
https://access.redhat.com/security/cve/CVE-2022-32085	self
https://bugzilla.redhat.com/show_bug.cgi?id=2104431	external
https://www.cve.org/CVERecord?id=CVE-2022-32085	external
https://nvd.nist.gov/vuln/detail/CVE-2022-32085	external
https://access.redhat.com/security/cve/CVE-2022-32086	self
https://bugzilla.redhat.com/show_bug.cgi?id=2104433	external
https://www.cve.org/CVERecord?id=CVE-2022-32086	external
https://nvd.nist.gov/vuln/detail/CVE-2022-32086	external
https://access.redhat.com/security/cve/CVE-2022-32087	self
https://bugzilla.redhat.com/show_bug.cgi?id=2104434	external
https://www.cve.org/CVERecord?id=CVE-2022-32087	external
https://nvd.nist.gov/vuln/detail/CVE-2022-32087	external
https://access.redhat.com/security/cve/CVE-2022-32088	self
https://bugzilla.redhat.com/show_bug.cgi?id=2106008	external
https://www.cve.org/CVERecord?id=CVE-2022-32088	external
https://nvd.nist.gov/vuln/detail/CVE-2022-32088	external
https://access.redhat.com/security/cve/CVE-2022-32089	self
https://bugzilla.redhat.com/show_bug.cgi?id=2106035	external
https://www.cve.org/CVERecord?id=CVE-2022-32089	external
https://nvd.nist.gov/vuln/detail/CVE-2022-32089	external
https://access.redhat.com/security/cve/CVE-2022-32091	self
https://bugzilla.redhat.com/show_bug.cgi?id=2106042	external
https://www.cve.org/CVERecord?id=CVE-2022-32091	external
https://nvd.nist.gov/vuln/detail/CVE-2022-32091	external
https://access.redhat.com/security/cve/CVE-2022-38791	self
https://bugzilla.redhat.com/show_bug.cgi?id=2130105	external
https://www.cve.org/CVERecord?id=CVE-2022-38791	external
https://nvd.nist.gov/vuln/detail/CVE-2022-38791	external
https://access.redhat.com/security/cve/CVE-2022-47015	self
https://bugzilla.redhat.com/show_bug.cgi?id=2163609	external
https://www.cve.org/CVERecord?id=CVE-2022-47015	external
https://nvd.nist.gov/vuln/detail/CVE-2022-47015	external
https://access.redhat.com/security/cve/CVE-2023-5157	self
https://bugzilla.redhat.com/show_bug.cgi?id=2240246	external
https://www.cve.org/CVERecord?id=CVE-2023-5157	external
https://nvd.nist.gov/vuln/detail/CVE-2023-5157	external

JSON

To clipboard

Loading 4.5 MB of JSON…

CVE-2021-2154 (GCVE-0-2021-2154)

Vulnerability from cvelistv5 – Published: 2021-04-22 21:53 – Updated: 2024-09-26 18:09

Summary

Severity

4.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-26 17:52 UTC

CWE

Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.

Assigner

oracle mitre root

References

7 references

URL	Tags
https://www.oracle.com/security-alerts/cpuapr2021.html	x_refsource_MISC
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://security.netapp.com/advisory/ntap-2021051…	x_refsource_CONFIRM
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://security.gentoo.org/glsa/202105-27	vendor-advisoryx_refsource_GENTOO
https://security.gentoo.org/glsa/202105-28	vendor-advisoryx_refsource_GENTOO

Impacted products

1 product

Vendor	Product	Version
Oracle Corporation	MySQL Server	Affected: 5.7.33 and prior

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T16:32:02.901Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuapr2021.html"
          },
          {
            "name": "FEDORA-2021-68db93b130",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DPA3CTGXPVWKHMCQDVURK4ETH7GE34KK/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20210513-0002/"
          },
          {
            "name": "FEDORA-2021-27187ac9dd",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GAU7KW36A6TQGKG3RUITYSVUFIHBY3OT/"
          },
          {
            "name": "FEDORA-2021-179f2fbb88",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PEF5CRATUGQZUSQU63MHQIDZPOLHW2VE/"
          },
          {
            "name": "GLSA-202105-27",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202105-27"
          },
          {
            "name": "GLSA-202105-28",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202105-28"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-2154",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-26T17:52:48.559702Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-26T18:09:56.531Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "MySQL Server",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "5.7.33 and prior"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 5.7.33 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-05-26T11:08:49.000Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuapr2021.html"
        },
        {
          "name": "FEDORA-2021-68db93b130",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DPA3CTGXPVWKHMCQDVURK4ETH7GE34KK/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20210513-0002/"
        },
        {
          "name": "FEDORA-2021-27187ac9dd",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GAU7KW36A6TQGKG3RUITYSVUFIHBY3OT/"
        },
        {
          "name": "FEDORA-2021-179f2fbb88",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PEF5CRATUGQZUSQU63MHQIDZPOLHW2VE/"
        },
        {
          "name": "GLSA-202105-27",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202105-27"
        },
        {
          "name": "GLSA-202105-28",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202105-28"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2021-2154",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "MySQL Server",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "5.7.33 and prior"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Oracle Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 5.7.33 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": "4.9",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.oracle.com/security-alerts/cpuapr2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuapr2021.html"
            },
            {
              "name": "FEDORA-2021-68db93b130",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DPA3CTGXPVWKHMCQDVURK4ETH7GE34KK/"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20210513-0002/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20210513-0002/"
            },
            {
              "name": "FEDORA-2021-27187ac9dd",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GAU7KW36A6TQGKG3RUITYSVUFIHBY3OT/"
            },
            {
              "name": "FEDORA-2021-179f2fbb88",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PEF5CRATUGQZUSQU63MHQIDZPOLHW2VE/"
            },
            {
              "name": "GLSA-202105-27",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202105-27"
            },
            {
              "name": "GLSA-202105-28",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202105-28"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2021-2154",
    "datePublished": "2021-04-22T21:53:45.000Z",
    "dateReserved": "2020-12-09T00:00:00.000Z",
    "dateUpdated": "2024-09-26T18:09:56.531Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-2166 (GCVE-0-2021-2166)

Vulnerability from cvelistv5 – Published: 2021-04-22 21:53 – Updated: 2024-09-26 15:33

Summary

Severity

4.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-26 14:44 UTC

CWE

Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.

Assigner

oracle mitre root

References

10 references

URL	Tags
https://www.oracle.com/security-alerts/cpuapr2021.html	x_refsource_MISC
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://security.netapp.com/advisory/ntap-2021051…	x_refsource_CONFIRM
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://security.gentoo.org/glsa/202105-27	vendor-advisoryx_refsource_GENTOO
https://security.gentoo.org/glsa/202105-28	vendor-advisoryx_refsource_GENTOO

Impacted products

1 product

Vendor	Product	Version
Oracle Corporation	MySQL Server	Affected: 5.7.33 and prior Affected: 8.0.23 and prior

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T16:32:03.139Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuapr2021.html"
          },
          {
            "name": "FEDORA-2021-01189f6361",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AKV7TRUEQW6EV45RSZVVFLVQMNHVHBCJ/"
          },
          {
            "name": "FEDORA-2021-5b6c69a73a",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UJVUTKKFQAWR7NURCQHQQ5JHTVYGEOYQ/"
          },
          {
            "name": "FEDORA-2021-b8b7829a83",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JJQRPXNDH6YHQLUSCS5VA7DAW32PN7N7/"
          },
          {
            "name": "FEDORA-2021-68db93b130",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DPA3CTGXPVWKHMCQDVURK4ETH7GE34KK/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20210513-0002/"
          },
          {
            "name": "FEDORA-2021-27187ac9dd",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GAU7KW36A6TQGKG3RUITYSVUFIHBY3OT/"
          },
          {
            "name": "FEDORA-2021-179f2fbb88",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PEF5CRATUGQZUSQU63MHQIDZPOLHW2VE/"
          },
          {
            "name": "GLSA-202105-27",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202105-27"
          },
          {
            "name": "GLSA-202105-28",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202105-28"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-2166",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-26T14:44:03.858496Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-26T15:33:03.082Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "MySQL Server",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "5.7.33 and prior"
            },
            {
              "status": "affected",
              "version": "8.0.23 and prior"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 5.7.33 and prior and 8.0.23 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-05-26T11:08:47.000Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuapr2021.html"
        },
        {
          "name": "FEDORA-2021-01189f6361",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AKV7TRUEQW6EV45RSZVVFLVQMNHVHBCJ/"
        },
        {
          "name": "FEDORA-2021-5b6c69a73a",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UJVUTKKFQAWR7NURCQHQQ5JHTVYGEOYQ/"
        },
        {
          "name": "FEDORA-2021-b8b7829a83",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JJQRPXNDH6YHQLUSCS5VA7DAW32PN7N7/"
        },
        {
          "name": "FEDORA-2021-68db93b130",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DPA3CTGXPVWKHMCQDVURK4ETH7GE34KK/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20210513-0002/"
        },
        {
          "name": "FEDORA-2021-27187ac9dd",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GAU7KW36A6TQGKG3RUITYSVUFIHBY3OT/"
        },
        {
          "name": "FEDORA-2021-179f2fbb88",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PEF5CRATUGQZUSQU63MHQIDZPOLHW2VE/"
        },
        {
          "name": "GLSA-202105-27",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202105-27"
        },
        {
          "name": "GLSA-202105-28",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202105-28"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2021-2166",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "MySQL Server",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "5.7.33 and prior"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "8.0.23 and prior"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Oracle Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 5.7.33 and prior and 8.0.23 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": "4.9",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.oracle.com/security-alerts/cpuapr2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuapr2021.html"
            },
            {
              "name": "FEDORA-2021-01189f6361",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AKV7TRUEQW6EV45RSZVVFLVQMNHVHBCJ/"
            },
            {
              "name": "FEDORA-2021-5b6c69a73a",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UJVUTKKFQAWR7NURCQHQQ5JHTVYGEOYQ/"
            },
            {
              "name": "FEDORA-2021-b8b7829a83",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JJQRPXNDH6YHQLUSCS5VA7DAW32PN7N7/"
            },
            {
              "name": "FEDORA-2021-68db93b130",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DPA3CTGXPVWKHMCQDVURK4ETH7GE34KK/"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20210513-0002/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20210513-0002/"
            },
            {
              "name": "FEDORA-2021-27187ac9dd",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GAU7KW36A6TQGKG3RUITYSVUFIHBY3OT/"
            },
            {
              "name": "FEDORA-2021-179f2fbb88",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PEF5CRATUGQZUSQU63MHQIDZPOLHW2VE/"
            },
            {
              "name": "GLSA-202105-27",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202105-27"
            },
            {
              "name": "GLSA-202105-28",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202105-28"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2021-2166",
    "datePublished": "2021-04-22T21:53:46.000Z",
    "dateReserved": "2020-12-09T00:00:00.000Z",
    "dateUpdated": "2024-09-26T15:33:03.082Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-2372 (GCVE-0-2021-2372)

Vulnerability from cvelistv5 – Published: 2021-07-20 22:43 – Updated: 2024-09-26 13:58

Summary

Severity

4.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-26 13:51 UTC

CWE

Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.

Assigner

oracle mitre root

References

6 references

URL	Tags
https://www.oracle.com/security-alerts/cpujul2021.html	x_refsource_MISC
https://security.netapp.com/advisory/ntap-2021072…	x_refsource_CONFIRM
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA

Impacted products

1 product

Vendor	Product	Version
Oracle Corporation	MySQL Server	Affected: 5.7.34 and prior Affected: 8.0.25 and prior

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T16:38:57.694Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujul2021.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20210723-0001/"
          },
          {
            "name": "FEDORA-2021-dc4299a8d0",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6OO2Q5PIFURXLLKCIJE6XF6VL4LLMNO5/"
          },
          {
            "name": "FEDORA-2021-df40c41094",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OPJAGVMRKODR4QIXQSVEM4BLRZUM7P3R/"
          },
          {
            "name": "FEDORA-2021-acef1dc8cf",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2UTW5KMPPDKIMGB4ULE2HS22HYLVKYIH/"
          },
          {
            "name": "FEDORA-2021-72d5918529",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VGR5ZTB5QEDRRC6G5U6TFNCIVBBKGS5J/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-2372",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-26T13:51:37.848097Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-26T13:58:15.119Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "MySQL Server",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "5.7.34 and prior"
            },
            {
              "status": "affected",
              "version": "8.0.25 and prior"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.34 and prior and 8.0.25 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-12-11T03:06:11.000Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujul2021.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20210723-0001/"
        },
        {
          "name": "FEDORA-2021-dc4299a8d0",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6OO2Q5PIFURXLLKCIJE6XF6VL4LLMNO5/"
        },
        {
          "name": "FEDORA-2021-df40c41094",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OPJAGVMRKODR4QIXQSVEM4BLRZUM7P3R/"
        },
        {
          "name": "FEDORA-2021-acef1dc8cf",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2UTW5KMPPDKIMGB4ULE2HS22HYLVKYIH/"
        },
        {
          "name": "FEDORA-2021-72d5918529",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VGR5ZTB5QEDRRC6G5U6TFNCIVBBKGS5J/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2021-2372",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "MySQL Server",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "5.7.34 and prior"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "8.0.25 and prior"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Oracle Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.34 and prior and 8.0.25 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": "4.4",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.oracle.com/security-alerts/cpujul2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujul2021.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20210723-0001/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20210723-0001/"
            },
            {
              "name": "FEDORA-2021-dc4299a8d0",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6OO2Q5PIFURXLLKCIJE6XF6VL4LLMNO5/"
            },
            {
              "name": "FEDORA-2021-df40c41094",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OPJAGVMRKODR4QIXQSVEM4BLRZUM7P3R/"
            },
            {
              "name": "FEDORA-2021-acef1dc8cf",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2UTW5KMPPDKIMGB4ULE2HS22HYLVKYIH/"
            },
            {
              "name": "FEDORA-2021-72d5918529",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VGR5ZTB5QEDRRC6G5U6TFNCIVBBKGS5J/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2021-2372",
    "datePublished": "2021-07-20T22:43:49.000Z",
    "dateReserved": "2020-12-09T00:00:00.000Z",
    "dateUpdated": "2024-09-26T13:58:15.119Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-2389 (GCVE-0-2021-2389)

Vulnerability from cvelistv5 – Published: 2021-07-20 22:44 – Updated: 2024-09-26 13:55

Summary

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.34 and prior and 8.0.25 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H).

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-26 13:51 UTC

CWE

Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.

Assigner

oracle mitre root

References

5 references

URL	Tags
https://www.oracle.com/security-alerts/cpujul2021.html	x_refsource_MISC
https://www.zerodayinitiative.com/advisories/ZDI-…	x_refsource_MISC
https://security.netapp.com/advisory/ntap-2021072…	x_refsource_CONFIRM
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA

Impacted products

1 product

Vendor	Product	Version
Oracle Corporation	MySQL Server	Affected: 5.7.34 and prior Affected: 8.0.25 and prior

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T16:38:57.616Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujul2021.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.zerodayinitiative.com/advisories/ZDI-21-880/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20210723-0001/"
          },
          {
            "name": "FEDORA-2021-acef1dc8cf",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2UTW5KMPPDKIMGB4ULE2HS22HYLVKYIH/"
          },
          {
            "name": "FEDORA-2021-72d5918529",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VGR5ZTB5QEDRRC6G5U6TFNCIVBBKGS5J/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-2389",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-26T13:51:18.748076Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-26T13:55:22.927Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "MySQL Server",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "5.7.34 and prior"
            },
            {
              "status": "affected",
              "version": "8.0.25 and prior"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.34 and prior and 8.0.25 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-12-11T03:06:09.000Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujul2021.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-21-880/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20210723-0001/"
        },
        {
          "name": "FEDORA-2021-acef1dc8cf",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2UTW5KMPPDKIMGB4ULE2HS22HYLVKYIH/"
        },
        {
          "name": "FEDORA-2021-72d5918529",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VGR5ZTB5QEDRRC6G5U6TFNCIVBBKGS5J/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2021-2389",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "MySQL Server",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "5.7.34 and prior"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "8.0.25 and prior"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Oracle Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.34 and prior and 8.0.25 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": "5.9",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.oracle.com/security-alerts/cpujul2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujul2021.html"
            },
            {
              "name": "https://www.zerodayinitiative.com/advisories/ZDI-21-880/",
              "refsource": "MISC",
              "url": "https://www.zerodayinitiative.com/advisories/ZDI-21-880/"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20210723-0001/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20210723-0001/"
            },
            {
              "name": "FEDORA-2021-acef1dc8cf",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2UTW5KMPPDKIMGB4ULE2HS22HYLVKYIH/"
            },
            {
              "name": "FEDORA-2021-72d5918529",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VGR5ZTB5QEDRRC6G5U6TFNCIVBBKGS5J/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2021-2389",
    "datePublished": "2021-07-20T22:44:03.000Z",
    "dateReserved": "2020-12-09T00:00:00.000Z",
    "dateUpdated": "2024-09-26T13:55:22.927Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-35604 (GCVE-0-2021-35604)

Vulnerability from cvelistv5 – Published: 2021-10-20 10:50 – Updated: 2024-09-25 19:26

Summary

Severity

5.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-25 19:14 UTC

CWE

Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data.

Assigner

oracle mitre root

References

7 references

URL	Tags
https://www.oracle.com/security-alerts/cpuoct2021.html	x_refsource_MISC
https://security.netapp.com/advisory/ntap-2021102…	x_refsource_CONFIRM
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA

Impacted products

1 product

Vendor	Product	Version
Oracle Corporation	MySQL Server	Affected: 5.7.35 and prior Affected: 8.0.26 and prior

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T00:40:47.385Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20211022-0003/"
          },
          {
            "name": "FEDORA-2021-70dd0b9f5d",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5MLAXYFLUDC636S46X34USCLDZAOFBM2/"
          },
          {
            "name": "FEDORA-2021-46dc82116b",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XF3ZFPL3JJ26YRUGXLXQZYJBLZV3WC2C/"
          },
          {
            "name": "FEDORA-2021-f74148c6d4",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PRCU3RTIPVKPC3GMC76YW7DJEXUEY6FG/"
          },
          {
            "name": "FEDORA-2021-acef1dc8cf",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2UTW5KMPPDKIMGB4ULE2HS22HYLVKYIH/"
          },
          {
            "name": "FEDORA-2021-72d5918529",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VGR5ZTB5QEDRRC6G5U6TFNCIVBBKGS5J/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-35604",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-25T19:14:38.231954Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-25T19:26:50.199Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "MySQL Server",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "5.7.35 and prior"
            },
            {
              "status": "affected",
              "version": "8.0.26 and prior"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.35 and prior and 8.0.26 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.1 Base Score 5.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as  unauthorized update, insert or delete access to some of MySQL Server accessible data.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-12-11T03:06:07.000Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20211022-0003/"
        },
        {
          "name": "FEDORA-2021-70dd0b9f5d",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5MLAXYFLUDC636S46X34USCLDZAOFBM2/"
        },
        {
          "name": "FEDORA-2021-46dc82116b",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XF3ZFPL3JJ26YRUGXLXQZYJBLZV3WC2C/"
        },
        {
          "name": "FEDORA-2021-f74148c6d4",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PRCU3RTIPVKPC3GMC76YW7DJEXUEY6FG/"
        },
        {
          "name": "FEDORA-2021-acef1dc8cf",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2UTW5KMPPDKIMGB4ULE2HS22HYLVKYIH/"
        },
        {
          "name": "FEDORA-2021-72d5918529",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VGR5ZTB5QEDRRC6G5U6TFNCIVBBKGS5J/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2021-35604",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "MySQL Server",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "5.7.35 and prior"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "8.0.26 and prior"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Oracle Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.35 and prior and 8.0.26 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.1 Base Score 5.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H)."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": "5.5",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as  unauthorized update, insert or delete access to some of MySQL Server accessible data."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.oracle.com/security-alerts/cpuoct2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20211022-0003/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20211022-0003/"
            },
            {
              "name": "FEDORA-2021-70dd0b9f5d",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5MLAXYFLUDC636S46X34USCLDZAOFBM2/"
            },
            {
              "name": "FEDORA-2021-46dc82116b",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XF3ZFPL3JJ26YRUGXLXQZYJBLZV3WC2C/"
            },
            {
              "name": "FEDORA-2021-f74148c6d4",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PRCU3RTIPVKPC3GMC76YW7DJEXUEY6FG/"
            },
            {
              "name": "FEDORA-2021-acef1dc8cf",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2UTW5KMPPDKIMGB4ULE2HS22HYLVKYIH/"
            },
            {
              "name": "FEDORA-2021-72d5918529",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VGR5ZTB5QEDRRC6G5U6TFNCIVBBKGS5J/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2021-35604",
    "datePublished": "2021-10-20T10:50:44.000Z",
    "dateReserved": "2021-06-28T00:00:00.000Z",
    "dateUpdated": "2024-09-25T19:26:50.199Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-46657 (GCVE-0-2021-46657)

Vulnerability from cvelistv5 – Published: 2022-01-29 22:34 – Updated: 2024-08-04 05:10

Summary

get_sort_by_table in MariaDB before 10.6.2 allows an application crash via certain subquery uses of ORDER BY.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

3 references

URL	Tags
https://jira.mariadb.org/browse/MDEV-25629	x_refsource_MISC
https://security.netapp.com/advisory/ntap-2022022…	x_refsource_CONFIRM
https://mariadb.com/kb/en/security/	x_refsource_CONFIRM

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:10:35.445Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://jira.mariadb.org/browse/MDEV-25629"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20220221-0002/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://mariadb.com/kb/en/security/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "get_sort_by_table in MariaDB before 10.6.2 allows an application crash via certain subquery uses of ORDER BY."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-03-15T17:34:44.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jira.mariadb.org/browse/MDEV-25629"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20220221-0002/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://mariadb.com/kb/en/security/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2021-46657",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "get_sort_by_table in MariaDB before 10.6.2 allows an application crash via certain subquery uses of ORDER BY."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://jira.mariadb.org/browse/MDEV-25629",
              "refsource": "MISC",
              "url": "https://jira.mariadb.org/browse/MDEV-25629"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20220221-0002/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20220221-0002/"
            },
            {
              "name": "https://mariadb.com/kb/en/security/",
              "refsource": "CONFIRM",
              "url": "https://mariadb.com/kb/en/security/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2021-46657",
    "datePublished": "2022-01-29T22:34:28.000Z",
    "dateReserved": "2022-01-29T00:00:00.000Z",
    "dateUpdated": "2024-08-04T05:10:35.445Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-46658 (GCVE-0-2021-46658)

Vulnerability from cvelistv5 – Published: 2022-01-29 22:34 – Updated: 2024-08-04 05:10

Summary

save_window_function_values in MariaDB before 10.6.3 allows an application crash because of incorrect handling of with_window_func=true for a subquery.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

3 references

URL	Tags
https://jira.mariadb.org/browse/MDEV-25630	x_refsource_MISC
https://security.netapp.com/advisory/ntap-2022022…	x_refsource_CONFIRM
https://mariadb.com/kb/en/security/	x_refsource_CONFIRM

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:10:35.337Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://jira.mariadb.org/browse/MDEV-25630"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20220221-0002/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://mariadb.com/kb/en/security/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "save_window_function_values in MariaDB before 10.6.3 allows an application crash because of incorrect handling of with_window_func=true for a subquery."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-03-15T17:35:05.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jira.mariadb.org/browse/MDEV-25630"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20220221-0002/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://mariadb.com/kb/en/security/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2021-46658",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "save_window_function_values in MariaDB before 10.6.3 allows an application crash because of incorrect handling of with_window_func=true for a subquery."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://jira.mariadb.org/browse/MDEV-25630",
              "refsource": "MISC",
              "url": "https://jira.mariadb.org/browse/MDEV-25630"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20220221-0002/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20220221-0002/"
            },
            {
              "name": "https://mariadb.com/kb/en/security/",
              "refsource": "CONFIRM",
              "url": "https://mariadb.com/kb/en/security/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2021-46658",
    "datePublished": "2022-01-29T22:34:16.000Z",
    "dateReserved": "2022-01-29T00:00:00.000Z",
    "dateUpdated": "2024-08-04T05:10:35.337Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-46659 (GCVE-0-2021-46659)

Vulnerability from cvelistv5 – Published: 2022-01-29 22:34 – Updated: 2024-08-04 05:10

Summary

MariaDB before 10.7.2 allows an application crash because it does not recognize that SELECT_LEX::nest_level is local to each VIEW.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

6 references

URL	Tags
https://jira.mariadb.org/browse/MDEV-25631	x_refsource_MISC
https://security.netapp.com/advisory/ntap-2022031…	x_refsource_CONFIRM
https://mariadb.com/kb/en/security/	x_refsource_CONFIRM
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:10:35.489Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://jira.mariadb.org/browse/MDEV-25631"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20220311-0003/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://mariadb.com/kb/en/security/"
          },
          {
            "name": "FEDORA-2022-263f7cc483",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NJ4KDAGF3H4D4BDTHRAM6ZEAJJWWMRUO/"
          },
          {
            "name": "FEDORA-2022-03350936ee",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DKJRBYJAQCOPHSED43A3HUPNKQLDTFGD/"
          },
          {
            "name": "FEDORA-2022-5cfe372ab7",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EZFZVMJL5UDTOZMARLXQIMG3BTG6UNYW/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "MariaDB before 10.7.2 allows an application crash because it does not recognize that SELECT_LEX::nest_level is local to each VIEW."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-05-08T03:06:47.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jira.mariadb.org/browse/MDEV-25631"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20220311-0003/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://mariadb.com/kb/en/security/"
        },
        {
          "name": "FEDORA-2022-263f7cc483",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NJ4KDAGF3H4D4BDTHRAM6ZEAJJWWMRUO/"
        },
        {
          "name": "FEDORA-2022-03350936ee",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DKJRBYJAQCOPHSED43A3HUPNKQLDTFGD/"
        },
        {
          "name": "FEDORA-2022-5cfe372ab7",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EZFZVMJL5UDTOZMARLXQIMG3BTG6UNYW/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2021-46659",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "MariaDB before 10.7.2 allows an application crash because it does not recognize that SELECT_LEX::nest_level is local to each VIEW."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://jira.mariadb.org/browse/MDEV-25631",
              "refsource": "MISC",
              "url": "https://jira.mariadb.org/browse/MDEV-25631"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20220311-0003/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20220311-0003/"
            },
            {
              "name": "https://mariadb.com/kb/en/security/",
              "refsource": "CONFIRM",
              "url": "https://mariadb.com/kb/en/security/"
            },
            {
              "name": "FEDORA-2022-263f7cc483",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJ4KDAGF3H4D4BDTHRAM6ZEAJJWWMRUO/"
            },
            {
              "name": "FEDORA-2022-03350936ee",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DKJRBYJAQCOPHSED43A3HUPNKQLDTFGD/"
            },
            {
              "name": "FEDORA-2022-5cfe372ab7",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EZFZVMJL5UDTOZMARLXQIMG3BTG6UNYW/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2021-46659",
    "datePublished": "2022-01-29T22:34:03.000Z",
    "dateReserved": "2022-01-29T00:00:00.000Z",
    "dateUpdated": "2024-08-04T05:10:35.489Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-46661 (GCVE-0-2021-46661)

Vulnerability from cvelistv5 – Published: 2022-02-01 01:48 – Updated: 2024-08-04 05:10

Summary

MariaDB through 10.5.9 allows an application crash in find_field_in_tables and find_order_in_list via an unused common table expression (CTE).

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

6 references

URL	Tags
https://jira.mariadb.org/browse/MDEV-25766	x_refsource_MISC
https://security.netapp.com/advisory/ntap-2022022…	x_refsource_CONFIRM
https://mariadb.com/kb/en/security/	x_refsource_CONFIRM
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:10:35.483Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://jira.mariadb.org/browse/MDEV-25766"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20220221-0002/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://mariadb.com/kb/en/security/"
          },
          {
            "name": "FEDORA-2022-263f7cc483",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NJ4KDAGF3H4D4BDTHRAM6ZEAJJWWMRUO/"
          },
          {
            "name": "FEDORA-2022-03350936ee",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DKJRBYJAQCOPHSED43A3HUPNKQLDTFGD/"
          },
          {
            "name": "FEDORA-2022-5cfe372ab7",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EZFZVMJL5UDTOZMARLXQIMG3BTG6UNYW/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "MariaDB through 10.5.9 allows an application crash in find_field_in_tables and find_order_in_list via an unused common table expression (CTE)."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-05-08T03:06:36.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jira.mariadb.org/browse/MDEV-25766"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20220221-0002/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://mariadb.com/kb/en/security/"
        },
        {
          "name": "FEDORA-2022-263f7cc483",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NJ4KDAGF3H4D4BDTHRAM6ZEAJJWWMRUO/"
        },
        {
          "name": "FEDORA-2022-03350936ee",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DKJRBYJAQCOPHSED43A3HUPNKQLDTFGD/"
        },
        {
          "name": "FEDORA-2022-5cfe372ab7",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EZFZVMJL5UDTOZMARLXQIMG3BTG6UNYW/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2021-46661",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "MariaDB through 10.5.9 allows an application crash in find_field_in_tables and find_order_in_list via an unused common table expression (CTE)."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://jira.mariadb.org/browse/MDEV-25766",
              "refsource": "MISC",
              "url": "https://jira.mariadb.org/browse/MDEV-25766"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20220221-0002/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20220221-0002/"
            },
            {
              "name": "https://mariadb.com/kb/en/security/",
              "refsource": "CONFIRM",
              "url": "https://mariadb.com/kb/en/security/"
            },
            {
              "name": "FEDORA-2022-263f7cc483",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJ4KDAGF3H4D4BDTHRAM6ZEAJJWWMRUO/"
            },
            {
              "name": "FEDORA-2022-03350936ee",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DKJRBYJAQCOPHSED43A3HUPNKQLDTFGD/"
            },
            {
              "name": "FEDORA-2022-5cfe372ab7",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EZFZVMJL5UDTOZMARLXQIMG3BTG6UNYW/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2021-46661",
    "datePublished": "2022-02-01T01:48:27.000Z",
    "dateReserved": "2022-02-01T00:00:00.000Z",
    "dateUpdated": "2024-08-04T05:10:35.483Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-46662 (GCVE-0-2021-46662)

Vulnerability from cvelistv5 – Published: 2022-02-01 01:47 – Updated: 2024-08-04 05:10

Summary

MariaDB through 10.5.9 allows a set_var.cc application crash via certain uses of an UPDATE statement in conjunction with a nested subquery.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

3 references

URL	Tags
https://jira.mariadb.org/browse/MDEV-25637	x_refsource_MISC
https://security.netapp.com/advisory/ntap-2022022…	x_refsource_CONFIRM
https://mariadb.com/kb/en/security/	x_refsource_CONFIRM

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:10:35.445Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://jira.mariadb.org/browse/MDEV-25637"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20220221-0002/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://mariadb.com/kb/en/security/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "MariaDB through 10.5.9 allows a set_var.cc application crash via certain uses of an UPDATE statement in conjunction with a nested subquery."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-03-15T17:35:53.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jira.mariadb.org/browse/MDEV-25637"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20220221-0002/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://mariadb.com/kb/en/security/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2021-46662",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "MariaDB through 10.5.9 allows a set_var.cc application crash via certain uses of an UPDATE statement in conjunction with a nested subquery."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://jira.mariadb.org/browse/MDEV-25637",
              "refsource": "MISC",
              "url": "https://jira.mariadb.org/browse/MDEV-25637"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20220221-0002/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20220221-0002/"
            },
            {
              "name": "https://mariadb.com/kb/en/security/",
              "refsource": "CONFIRM",
              "url": "https://mariadb.com/kb/en/security/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2021-46662",
    "datePublished": "2022-02-01T01:47:53.000Z",
    "dateReserved": "2022-02-01T00:00:00.000Z",
    "dateUpdated": "2024-08-04T05:10:35.445Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2023:6821

CVE-2021-2154 (GCVE-0-2021-2154)

CVE-2021-2166 (GCVE-0-2021-2166)

CVE-2021-2372 (GCVE-0-2021-2372)

CVE-2021-2389 (GCVE-0-2021-2389)

CVE-2021-35604 (GCVE-0-2021-35604)

CVE-2021-46657 (GCVE-0-2021-46657)

CVE-2021-46658 (GCVE-0-2021-46658)

CVE-2021-46659 (GCVE-0-2021-46659)

CVE-2021-46661 (GCVE-0-2021-46661)

CVE-2021-46662 (GCVE-0-2021-46662)

Tags

Sightings

Nomenclature

Related by attack behaviour