Vulnerability-Lookup

RHSA-2025:1673

Vulnerability from csaf_redhat - Published: 2025-02-19 11:10 - Updated: 2026-09-14 14:50

Summary

Red Hat Security Advisory: mysql:8.0 security update

Severity

Important

Notes

Topic: An update for the mysql:8.0 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon (mysqld) and many client programs and libraries. Security Fix(es): * openssl: SSL_select_next_proto buffer overread (CVE-2024-5535) * krb5: GSS message token handling (CVE-2024-37371) * curl: libcurl: ASN.1 date parser overread (CVE-2024-7264) * mysql: Thread Pooling unspecified vulnerability (CPU Oct 2024) (CVE-2024-21238) * mysql: X Plugin unspecified vulnerability (CPU Oct 2024) (CVE-2024-21196) * mysql: Optimizer unspecified vulnerability (CPU Oct 2024) (CVE-2024-21241) * mysql: Client programs unspecified vulnerability (CPU Oct 2024) (CVE-2024-21231) * mysql: Information Schema unspecified vulnerability (CPU Oct 2024) (CVE-2024-21197) * mysql: InnoDB unspecified vulnerability (CPU Oct 2024) (CVE-2024-21218) * mysql: Optimizer unspecified vulnerability (CPU Oct 2024) (CVE-2024-21201) * mysql: InnoDB unspecified vulnerability (CPU Oct 2024) (CVE-2024-21236) * mysql: Group Replication GCS unspecified vulnerability (CPU Oct 2024) (CVE-2024-21237) * mysql: FTS unspecified vulnerability (CPU Oct 2024) (CVE-2024-21203) * mysql: Health Monitor unspecified vulnerability (CPU Oct 2024) (CVE-2024-21212) * mysql: DML unspecified vulnerability (CPU Oct 2024) (CVE-2024-21219) * mysql: Optimizer unspecified vulnerability (CPU Oct 2024) (CVE-2024-21230) * mysql: InnoDB unspecified vulnerability (CPU Oct 2024) (CVE-2024-21213) * mysql: InnoDB unspecified vulnerability (CPU Oct 2024) (CVE-2024-21194) * mysql: InnoDB unspecified vulnerability (CPU Oct 2024) (CVE-2024-21199) * mysql: PS unspecified vulnerability (CPU Oct 2024) (CVE-2024-21193) * mysql: DDL unspecified vulnerability (CPU Oct 2024) (CVE-2024-21198) * mysql: mysqldump unspecified vulnerability (CPU Oct 2024) (CVE-2024-21247) * mysql: InnoDB unspecified vulnerability (CPU Oct 2024) (CVE-2024-21239) * curl: curl netrc password leak (CVE-2024-11053) * mysql: InnoDB unspecified vulnerability (CPU Jan 2025) (CVE-2025-21497) * mysql: MySQL Server Options Vulnerability (CVE-2025-21520) * mysql: High Privilege Denial of Service Vulnerability in MySQL Server (CVE-2025-21490) * mysql: Information Schema unspecified vulnerability (CPU Jan 2025) (CVE-2025-21529) * mysql: InnoDB unspecified vulnerability (CPU Jan 2025) (CVE-2025-21531) * mysql: Optimizer unspecified vulnerability (CPU Jan 2025) (CVE-2025-21504) * mysql: Privileges unspecified vulnerability (CPU Jan 2025) (CVE-2025-21540) * mysql: MySQL Server InnoDB Denial of Service and Unauthorized Data Modification Vulnerability (CVE-2025-21555) * mysql: Packaging unspecified vulnerability (CPU Jan 2025) (CVE-2025-21543) * mysql: MySQL Server InnoDB Denial of Service and Unauthorized Data Modification Vulnerability (CVE-2025-21491) * mysql: DDL unspecified vulnerability (CPU Jan 2025) (CVE-2025-21525) * mysql: Optimizer unspecified vulnerability (CPU Jan 2025) (CVE-2025-21536) * mysql: Thread Pooling unspecified vulnerability (CPU Jan 2025) (CVE-2025-21521) * mysql: Optimizer unspecified vulnerability (CPU Jan 2025) (CVE-2025-21501) * mysql: Performance Schema unspecified vulnerability (CPU Jan 2025) (CVE-2025-21534) * mysql: Privileges unspecified vulnerability (CPU Jan 2025) (CVE-2025-21494) * mysql: Privileges unspecified vulnerability (CPU Jan 2025) (CVE-2025-21519) * mysql: Parser unspecified vulnerability (CPU Jan 2025) (CVE-2025-21522) * mysql: InnoDB unspecified vulnerability (CPU Jan 2025) (CVE-2025-21503) * mysql: Optimizer unspecified vulnerability (CPU Jan 2025) (CVE-2025-21518) * mysql: MySQL Server InnoDB Denial of Service and Unauthorized Data Modification Vulnerability (CVE-2025-21559) * mysql: Privilege Misuse in MySQL Server Security Component (CVE-2025-21546) * mysql: Optimizer unspecified vulnerability (CPU Jan 2025) (CVE-2025-21500) * mysql: InnoDB unspecified vulnerability (CPU Jan 2025) (CVE-2025-21523) * mysql: Components Services unspecified vulnerability (CPU Jan 2025) (CVE-2025-21505) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2024-5535

A flaw was found in OpenSSL. Affected versions of this package are vulnerable to Information Exposure through the SSL_select_next_proto function. This flaw allows an attacker to cause unexpected application behavior or a crash by exploiting the buffer overread condition when the function is called with a zero-length client list. This issue is only exploitable if the application is misconfigured to use a zero-length server list and mishandles the 'no overlap' response in ALPN or uses the output as the opportunistic protocol in NPN.

5.9 (Medium)


                
                  CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Affected products

Fixed 79 products

Product	Version	Remediation
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:mecab-0:0.996-2.module+el8.10.0+22857+7f331edd.aarch64::mysql:8.0	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:mecab-0:0.996-2.module+el8.10.0+22857+7f331edd.ppc64le::mysql:8.0	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:mecab-0:0.996-2.module+el8.10.0+22857+7f331edd.s390x::mysql:8.0	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:mecab-0:0.996-2.module+el8.10.0+22857+7f331edd.src::mysql:8.0	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:mecab-0:0.996-2.module+el8.10.0+22857+7f331edd.x86_64::mysql:8.0	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:mecab-debuginfo-0:0.996-2.module+el8.10.0+22857+7f331edd.aarch64::mysql:8.0	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:mecab-debuginfo-0:0.996-2.module+el8.10.0+22857+7f331edd.ppc64le::mysql:8.0	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:mecab-debuginfo-0:0.996-2.module+el8.10.0+22857+7f331edd.s390x::mysql:8.0	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:mecab-debuginfo-0:0.996-2.module+el8.10.0+22857+7f331edd.x86_64::mysql:8.0	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:mecab-debugsource-0:0.996-2.module+el8.10.0+22857+7f331edd.aarch64::mysql:8.0	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:mecab-debugsource-0:0.996-2.module+el8.10.0+22857+7f331edd.ppc64le::mysql:8.0	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:mecab-debugsource-0:0.996-2.module+el8.10.0+22857+7f331edd.s390x::mysql:8.0	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:mecab-debugsource-0:0.996-2.module+el8.10.0+22857+7f331edd.x86_64::mysql:8.0	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:mecab-devel-0:0.996-2.module+el8.10.0+22857+7f331edd.aarch64::mysql:8.0	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:mecab-devel-0:0.996-2.module+el8.10.0+22857+7f331edd.ppc64le::mysql:8.0	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:mecab-devel-0:0.996-2.module+el8.10.0+22857+7f331edd.s390x::mysql:8.0	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:mecab-devel-0:0.996-2.module+el8.10.0+22857+7f331edd.x86_64::mysql:8.0	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:mecab-ipadic-0:2.7.0.20070801-17.module+el8.10.0+22857+7f331edd.aarch64::mysql:8.0	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:mecab-ipadic-0:2.7.0.20070801-17.module+el8.10.0+22857+7f331edd.ppc64le::mysql:8.0	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:mecab-ipadic-0:2.7.0.20070801-17.module+el8.10.0+22857+7f331edd.s390x::mysql:8.0	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:mecab-ipadic-0:2.7.0.20070801-17.module+el8.10.0+22857+7f331edd.src::mysql:8.0	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:mecab-ipadic-0:2.7.0.20070801-17.module+el8.10.0+22857+7f331edd.x86_64::mysql:8.0	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:mecab-ipadic-EUCJP-0:2.7.0.20070801-17.module+el8.10.0+22857+7f331edd.aarch64::mysql:8.0	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:mecab-ipadic-EUCJP-0:2.7.0.20070801-17.module+el8.10.0+22857+7f331edd.ppc64le::mysql:8.0	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:mecab-ipadic-EUCJP-0:2.7.0.20070801-17.module+el8.10.0+22857+7f331edd.s390x::mysql:8.0	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:mecab-ipadic-EUCJP-0:2.7.0.20070801-17.module+el8.10.0+22857+7f331edd.x86_64::mysql:8.0	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:mysql-0:8.0.41-1.module+el8.10.0+22857+7f331edd.aarch64::mysql:8.0	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:mysql-0:8.0.41-1.module+el8.10.0+22857+7f331edd.ppc64le::mysql:8.0	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:mysql-0:8.0.41-1.module+el8.10.0+22857+7f331edd.s390x::mysql:8.0	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:mysql-0:8.0.41-1.module+el8.10.0+22857+7f331edd.src::mysql:8.0	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:mysql-0:8.0.41-1.module+el8.10.0+22857+7f331edd.x86_64::mysql:8.0	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:mysql-common-0:8.0.41-1.module+el8.10.0+22857+7f331edd.aarch64::mysql:8.0	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:mysql-common-0:8.0.41-1.module+el8.10.0+22857+7f331edd.ppc64le::mysql:8.0	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:mysql-common-0:8.0.41-1.module+el8.10.0+22857+7f331edd.s390x::mysql:8.0	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:mysql-common-0:8.0.41-1.module+el8.10.0+22857+7f331edd.x86_64::mysql:8.0	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:mysql-debuginfo-0:8.0.41-1.module+el8.10.0+22857+7f331edd.aarch64::mysql:8.0	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:mysql-debuginfo-0:8.0.41-1.module+el8.10.0+22857+7f331edd.ppc64le::mysql:8.0	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:mysql-debuginfo-0:8.0.41-1.module+el8.10.0+22857+7f331edd.s390x::mysql:8.0	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:mysql-debuginfo-0:8.0.41-1.module+el8.10.0+22857+7f331edd.x86_64::mysql:8.0	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:mysql-debugsource-0:8.0.41-1.module+el8.10.0+22857+7f331edd.aarch64::mysql:8.0	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:mysql-debugsource-0:8.0.41-1.module+el8.10.0+22857+7f331edd.ppc64le::mysql:8.0	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:mysql-debugsource-0:8.0.41-1.module+el8.10.0+22857+7f331edd.s390x::mysql:8.0	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:mysql-debugsource-0:8.0.41-1.module+el8.10.0+22857+7f331edd.x86_64::mysql:8.0	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:mysql-devel-0:8.0.41-1.module+el8.10.0+22857+7f331edd.aarch64::mysql:8.0	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:mysql-devel-0:8.0.41-1.module+el8.10.0+22857+7f331edd.ppc64le::mysql:8.0	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:mysql-devel-0:8.0.41-1.module+el8.10.0+22857+7f331edd.s390x::mysql:8.0	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:mysql-devel-0:8.0.41-1.module+el8.10.0+22857+7f331edd.x86_64::mysql:8.0	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:mysql-devel-debuginfo-0:8.0.41-1.module+el8.10.0+22857+7f331edd.aarch64::mysql:8.0	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:mysql-devel-debuginfo-0:8.0.41-1.module+el8.10.0+22857+7f331edd.ppc64le::mysql:8.0	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:mysql-devel-debuginfo-0:8.0.41-1.module+el8.10.0+22857+7f331edd.s390x::mysql:8.0	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:mysql-devel-debuginfo-0:8.0.41-1.module+el8.10.0+22857+7f331edd.x86_64::mysql:8.0	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:mysql-errmsg-0:8.0.41-1.module+el8.10.0+22857+7f331edd.aarch64::mysql:8.0	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:mysql-errmsg-0:8.0.41-1.module+el8.10.0+22857+7f331edd.ppc64le::mysql:8.0	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:mysql-errmsg-0:8.0.41-1.module+el8.10.0+22857+7f331edd.s390x::mysql:8.0	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:mysql-errmsg-0:8.0.41-1.module+el8.10.0+22857+7f331edd.x86_64::mysql:8.0	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:mysql-libs-0:8.0.41-1.module+el8.10.0+22857+7f331edd.aarch64::mysql:8.0	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:mysql-libs-0:8.0.41-1.module+el8.10.0+22857+7f331edd.ppc64le::mysql:8.0	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:mysql-libs-0:8.0.41-1.module+el8.10.0+22857+7f331edd.s390x::mysql:8.0	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:mysql-libs-0:8.0.41-1.module+el8.10.0+22857+7f331edd.x86_64::mysql:8.0	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:mysql-libs-debuginfo-0:8.0.41-1.module+el8.10.0+22857+7f331edd.aarch64::mysql:8.0	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:mysql-libs-debuginfo-0:8.0.41-1.module+el8.10.0+22857+7f331edd.ppc64le::mysql:8.0	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:mysql-libs-debuginfo-0:8.0.41-1.module+el8.10.0+22857+7f331edd.s390x::mysql:8.0	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:mysql-libs-debuginfo-0:8.0.41-1.module+el8.10.0+22857+7f331edd.x86_64::mysql:8.0	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:mysql-server-0:8.0.41-1.module+el8.10.0+22857+7f331edd.aarch64::mysql:8.0	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:mysql-server-0:8.0.41-1.module+el8.10.0+22857+7f331edd.ppc64le::mysql:8.0	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:mysql-server-0:8.0.41-1.module+el8.10.0+22857+7f331edd.s390x::mysql:8.0	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:mysql-server-0:8.0.41-1.module+el8.10.0+22857+7f331edd.x86_64::mysql:8.0	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:mysql-server-debuginfo-0:8.0.41-1.module+el8.10.0+22857+7f331edd.aarch64::mysql:8.0	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:mysql-server-debuginfo-0:8.0.41-1.module+el8.10.0+22857+7f331edd.ppc64le::mysql:8.0	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:mysql-server-debuginfo-0:8.0.41-1.module+el8.10.0+22857+7f331edd.s390x::mysql:8.0	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:mysql-server-debuginfo-0:8.0.41-1.module+el8.10.0+22857+7f331edd.x86_64::mysql:8.0	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:mysql-test-0:8.0.41-1.module+el8.10.0+22857+7f331edd.aarch64::mysql:8.0	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:mysql-test-0:8.0.41-1.module+el8.10.0+22857+7f331edd.ppc64le::mysql:8.0	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:mysql-test-0:8.0.41-1.module+el8.10.0+22857+7f331edd.s390x::mysql:8.0	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:mysql-test-0:8.0.41-1.module+el8.10.0+22857+7f331edd.x86_64::mysql:8.0	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:mysql-test-debuginfo-0:8.0.41-1.module+el8.10.0+22857+7f331edd.aarch64::mysql:8.0	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:mysql-test-debuginfo-0:8.0.41-1.module+el8.10.0+22857+7f331edd.ppc64le::mysql:8.0	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:mysql-test-debuginfo-0:8.0.41-1.module+el8.10.0+22857+7f331edd.s390x::mysql:8.0	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:mysql-test-debuginfo-0:8.0.41-1.module+el8.10.0+22857+7f331edd.x86_64::mysql:8.0	—	Vendor Fix fix Workaround

Threats

Impact Low

CVE-2024-7264

A flaw was found in libcurl, where libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an ASN.1 Generalized Time field. If a syntactically incorrect field is given, the parser can use -1 for the length of the *time fraction*, leading to a `strlen()` performed on a pointer to a heap buffer area that is not purposely NULL terminated.

5.3 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H

CWE-125 - Out-of-bounds Read

Affected products

Fixed 79 products, the same list as for CVE-2024-5535

Threats

Impact Low

CVE-2024-11053

A flaw was found in curl. A logic error when processing credentials from the .netrc file while performing redirects allows the transfer of credentials from the original host to the followed-to host under certain circumstances, leaking the credentials to the followed-to host.

5.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Affected products

Fixed 79 products, the same list as for CVE-2024-5535

Threats

Impact Low

CVE-2024-21193

A flaw was found in the MySQL Server product of Oracle MySQL. This vulnerability allows a remote attacker to cause a denial of service (DoS).

4.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-20 - Improper Input Validation

Affected products

Fixed 79 products, the same list as for CVE-2024-5535

Threats

Impact Moderate

CVE-2024-21194

A flaw was found in the MySQL Server product of Oracle MySQL. This vulnerability allows a remote attacker to cause a denial of service (DoS).

4.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-20 - Improper Input Validation

Affected products

Fixed 79 products, the same list as for CVE-2024-5535

Threats

Impact Moderate

CVE-2024-21196

A flaw was found in the MySQL Server product of Oracle MySQL. This vulnerability allows a remote attacker to cause a denial of service (DoS).

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-20 - Improper Input Validation

Affected products

Fixed 79 products, the same list as for CVE-2024-5535

Threats

Impact Moderate

CVE-2024-21197

A flaw was found in the MySQL Server product of Oracle MySQL. This vulnerability allows a remote attacker to cause a denial of service (DoS).

4.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-20 - Improper Input Validation

Affected products

Fixed 79 products, the same list as for CVE-2024-5535

Threats

Impact Moderate

CVE-2024-21198

A flaw was found in the MySQL Server product of Oracle MySQL. This vulnerability allows a remote attacker to cause a denial of service (DoS).

4.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-20 - Improper Input Validation

Affected products

Fixed 79 products, the same list as for CVE-2024-5535

Threats

Impact Moderate

CVE-2024-21199

A flaw was found in the MySQL Server product of Oracle MySQL. This vulnerability allows a remote attacker to cause a denial of service (DoS).

4.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-20 - Improper Input Validation

Affected products

Fixed 79 products, the same list as for CVE-2024-5535

Threats

Impact Moderate

CVE-2024-21201

A flaw was found in the MySQL Server product of Oracle MySQL. This vulnerability allows a remote attacker to cause a denial of service (DoS).

4.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-20 - Improper Input Validation

Affected products

Fixed 79 products, the same list as for CVE-2024-5535

Threats

Impact Moderate

CVE-2024-21203

A flaw was found in the MySQL Server product of Oracle MySQL. This vulnerability allows a remote attacker to cause a denial of service (DoS).

4.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-20 - Improper Input Validation

Affected products

Fixed 79 products, the same list as for CVE-2024-5535

Threats

Impact Moderate

CVE-2024-21212

A flaw was found in the MySQL Server product of Oracle MySQL. This vulnerability allows a remote attacker to cause a denial of service (DoS).

4.4 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-20 - Improper Input Validation

Affected products

Fixed 79 products, the same list as for CVE-2024-5535

Threats

Impact Moderate

CVE-2024-21213

A flaw was found in Oracle MySQL Server (InnoDB component). A high-privileged local attacker with logon access to the MySQL Server infrastructure can cause a denial of service (DoS) of MySQL Server. This vulnerability requires user interaction.

4.2 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H

CWE-20 - Improper Input Validation

Affected products

Fixed 79 products, the same list as for CVE-2024-5535

Threats

Impact Moderate

CVE-2024-21218

A flaw was found in the MySQL Server product of Oracle MySQL. This vulnerability allows a remote attacker to cause a denial of service (DoS).

4.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-20 - Improper Input Validation

Affected products

Fixed 79 products, the same list as for CVE-2024-5535

Threats

Impact Moderate

CVE-2024-21219

A flaw was found in the MySQL Server product of Oracle MySQL. This vulnerability allows a remote attacker to cause a denial of service (DoS).

4.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-20 - Improper Input Validation

Affected products

Fixed 79 products, the same list as for CVE-2024-5535

Threats

Impact Moderate

CVE-2024-21230

A flaw was found in the MySQL Server product of Oracle MySQL. This vulnerability allows a remote attacker to cause a denial of service (DoS).

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-20 - Improper Input Validation

Affected products

Fixed 79 products, the same list as for CVE-2024-5535

Threats

Impact Moderate

CVE-2024-21231

Vulnerability in the MySQL Server product of Oracle MySQL (component: Client programs). Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and 9.0.1 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server. CVSS 3.1 Base Score 3.1 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L).

3.1 (Low)


                
                  CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

Affected products

Fixed 79 products, the same list as for CVE-2024-5535

Threats

Impact Low

CVE-2024-21236

A flaw was found in the MySQL Server product of Oracle MySQL. This vulnerability allows a remote attacker to cause a denial of service (DoS).

4.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-20 - Improper Input Validation

Affected products

Fixed 79 products, the same list as for CVE-2024-5535

Threats

Impact Moderate

CVE-2024-21237

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Group Replication GCS). Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and 9.0.1 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server. CVSS 3.1 Base Score 2.2 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L).

2.2 (Low)


                
                  CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L

Affected products

Fixed 79 products, the same list as for CVE-2024-5535

Threats

Impact Low

CVE-2024-21238

A flaw was found in the MySQL Server product of Oracle MySQL. This vulnerability allows a remote attacker to cause a denial of service (DoS).

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-20 - Improper Input Validation

Affected products

Fixed 79 products, the same list as for CVE-2024-5535

Threats

Impact Moderate

CVE-2024-21239

A flaw was found in Oracle MySQL Server (InnoDB component). A high-privileged attacker with network access via multiple protocols can cause a denial of service (DoS) of MySQL Server.

4.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-20 - Improper Input Validation

Affected products

Fixed 79 products, the same list as for CVE-2024-5535

Threats

Impact Moderate

CVE-2024-21241

A flaw was found in the MySQL Server product of Oracle MySQL. This vulnerability allows a remote attacker to cause a denial of service (DoS).

4.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-20 - Improper Input Validation

Affected products

Fixed 79 products, the same list as for CVE-2024-5535

Threats

Impact Moderate

CVE-2024-21247

Vulnerability in the MySQL Client product of Oracle MySQL (component: Client: mysqldump). Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and 9.0.1 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Client. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Client accessible data as well as unauthorized read access to a subset of MySQL Client accessible data. CVSS 3.1 Base Score 3.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N).

3.8 (Low)


                
                  CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

Affected products

Fixed 79 products, the same list as for CVE-2024-5535

Threats

Impact Low

CVE-2024-37371

A vulnerability was found in the MIT Kerberos 5 GSS krb5 wrap token, where an attacker can modify the plaintext Extra Count field, causing the unwrapped token to appear truncated to the application, occurs when the attacker alters the token data during transmission which can lead to improper handling of authentication tokens.

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-125 - Out-of-bounds Read

Affected products

Fixed 79 products, the same list as for CVE-2024-5535

Threats

Impact Moderate

CVE-2025-21490

A flaw was found in the MySQL Server component: InnoDB. This vulnerability allows a high-privileged attacker to cause a denial of service, which causes frequent crashes or hangs, via multiple network protocols.

4.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-404 - Improper Resource Shutdown or Release

Affected products

Fixed 79 products, the same list as for CVE-2024-5535

Threats

Impact Moderate

CVE-2025-21491

A flaw was found in MySQL Server, specifically in the InnoDB component. This vulnerability allows a high-privileged attacker to cause a hang or frequently repeatable crash, resulting in a complete denial of service via network access through multiple protocols.

4.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-404 - Improper Resource Shutdown or Release

Affected products

Fixed 79 products, the same list as for CVE-2024-5535

Threats

Impact Moderate

CVE-2025-21494

A flaw was found in Oracle MySQL Server (Security: Privileges component). A high-privileged local attacker with logon access to the MySQL Server infrastructure can cause a denial of service (DoS) of MySQL Server.

4.1 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-20 - Improper Input Validation

Affected products

Fixed 79 products, the same list as for CVE-2024-5535

Threats

Impact Moderate

CVE-2025-21497

A flaw was found in Oracle MySQL Server (InnoDB component). A high-privileged remote attacker with network access can cause a denial of service (DoS) and gain unauthorized ability to modify data in MySQL Server.

5.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H

CWE-20 - Improper Input Validation

Affected products

Fixed 79 products, the same list as for CVE-2024-5535

Threats

Impact Moderate

CVE-2025-21500

A flaw was found in the MySQL Server product of Oracle MySQL. This vulnerability allows a remote attacker to cause a denial of service (DoS).

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-20 - Improper Input Validation

Affected products

Fixed 79 products, the same list as for CVE-2024-5535

Threats

Impact Moderate

CVE-2025-21501

A flaw was found in the MySQL Server product of Oracle MySQL. This vulnerability allows a remote attacker to cause a denial of service (DoS).

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-20 - Improper Input Validation

Affected products

Fixed 79 products, the same list as for CVE-2024-5535

Threats

Impact Moderate

CVE-2025-21503

A flaw was found in the MySQL Server product of Oracle MySQL. This vulnerability allows a remote attacker to cause a denial of service (DoS).

4.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-20 - Improper Input Validation

Affected products

Fixed 79 products, the same list as for CVE-2024-5535

Threats

Impact Moderate

CVE-2025-21504

A flaw was found in the MySQL Server product of Oracle MySQL. This vulnerability allows a remote attacker to cause a denial of service (DoS).

4.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-20 - Improper Input Validation

Affected products

Fixed 79 products, the same list as for CVE-2024-5535

Threats

Impact Moderate

CVE-2025-21505

A flaw was found in the MySQL Server product of Oracle MySQL. This vulnerability allows a remote attacker to cause a denial of service (DoS).

4.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-20 - Improper Input Validation

Affected products

Fixed 79 products, the same list as for CVE-2024-5535

Threats

Impact Moderate

CVE-2025-21518

A flaw was found in the MySQL Server product of Oracle MySQL. This vulnerability allows a remote attacker to cause a denial of service (DoS).

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-20 - Improper Input Validation

Affected products

Fixed 79 products, the same list as for CVE-2024-5535

Threats

Impact Moderate

CVE-2025-21519

A flaw was found in the MySQL Server product of Oracle MySQL. This vulnerability allows a remote attacker to cause a denial of service (DoS).

4.4 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-20 - Improper Input Validation

Affected products

Fixed 79 products, the same list as for CVE-2024-5535

Threats

Impact Moderate

CVE-2025-21520

A flaw was found in MySQL Server (component: Options). This issue may allow unauthorized read access to a subset of MySQL Server data via a high-privileged attacker with logon to the infrastructure and requires human interaction from another user.

1.8 (Low)


                
                  CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N

CWE-285 - Improper Authorization

Affected products

Fixed 79 products, the same list as for CVE-2024-5535

Threats

Impact Low

CVE-2025-21521

A flaw was found in MySQL Server (Thread Pooling component). This vulnerability allows a denial of service (DoS) via network access through multiple protocols by an unauthenticated attacker.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Affected products

Fixed 79 products, the same list as for CVE-2024-5535

Threats

Impact Important

CVE-2025-21522

A flaw was found in the MySQL Server product of Oracle MySQL. This vulnerability allows a remote attacker to cause a denial of service (DoS).

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-20 - Improper Input Validation

Affected products

Fixed 79 products, the same list as for CVE-2024-5535

Threats

Impact Moderate

CVE-2025-21523

A flaw was found in the MySQL Server product of Oracle MySQL. This vulnerability allows a remote attacker to cause a denial of service (DoS).

4.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-20 - Improper Input Validation

Affected products

Fixed 79 products, the same list as for CVE-2024-5535

Threats

Impact Moderate

CVE-2025-21525

A flaw was found in the MySQL Server product of Oracle MySQL. This vulnerability allows a remote attacker to cause a denial of service (DoS).

4.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-20 - Improper Input Validation

Affected products

Fixed 79 products, the same list as for CVE-2024-5535

Threats

Impact Moderate

CVE-2025-21529

A flaw was found in MySQL Server. This vulnerability allows a high privileged attacker to cause a complete denial of service (DoS) via network access using multiple protocols.

4.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-617 - Reachable Assertion

Affected products

Fixed 79 products, the same list as for CVE-2024-5535

Threats

Impact Moderate

CVE-2025-21531

A flaw was found in the MySQL Server product of Oracle MySQL. This vulnerability allows a remote attacker to cause a denial of service (DoS).

4.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-20 - Improper Input Validation

Affected products

Fixed 79 products, the same list as for CVE-2024-5535

Threats

Impact Moderate

CVE-2025-21534

A flaw was found in the MySQL Server product of Oracle MySQL. This vulnerability allows a remote attacker to cause a denial of service (DoS).

4.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-20 - Improper Input Validation

Affected products

Fixed 79 products, the same list as for CVE-2024-5535

Threats

Impact Moderate

CVE-2025-21536

A flaw was found in the MySQL Server product of Oracle MySQL. This vulnerability allows a remote attacker to cause a denial of service (DoS).

4.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-20 - Improper Input Validation

Affected products

Fixed 79 products, the same list as for CVE-2024-5535

Threats

Impact Moderate

CVE-2025-21540

A flaw was found in Oracle MySQL Server (Security: Privileges component). A low-privileged remote attacker with network access can gain unauthorized read and write access to MySQL Server data.

5.4 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

CWE-862 - Missing Authorization

Affected products

Fixed 79 products, the same list as for CVE-2024-5535

Threats

Impact Moderate

CVE-2025-21543

A flaw was found in MySQL Server. This vulnerability allows unauthorized remote attacker to cause a denial of service (DoS).

4.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-20 - Improper Input Validation

Affected products

Fixed 79 products, the same list as for CVE-2024-5535

Threats

Impact Moderate

CVE-2025-21546

A flaw was found in MySQL Server (component: Security: Privileges). This issue can allow unauthorized update, insert, or delete access to MySQL Server data and unauthorized read access to a subset of data via multiple protocols.

3.8 (Low)


                
                  CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

CWE-269 - Improper Privilege Management

Affected products

Fixed 79 products, the same list as for CVE-2024-5535

Threats

Impact Low

CVE-2025-21555

A flaw was found in MySQL Server, specifically in the InnoDB component. This vulnerability allows a high-privileged attacker to cause a denial of service, which causes frequent crashes or hangs and unauthorized modification, such as updating, inserting, or deleting accessible data via multiple network protocols.

5.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H

CWE-404 - Improper Resource Shutdown or Release

Affected products

Fixed 79 products, the same list as for CVE-2024-5535

Threats

Impact Moderate

CVE-2025-21559

A flaw was found in MySQL Server, specifically in the InnoDB component. This vulnerability allows a high-privileged attacker to cause a denial of service, causing frequent crashes or hangs, and unauthorized modification to including updating, inserting, and deleting accessible data via multiple network protocols.

5.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H

CWE-404 - Improper Resource Shutdown or Release

Affected products

Fixed 79 products, the same list as for CVE-2024-5535

Threats

Impact Moderate

References

253 references

URL	Category
https://access.redhat.com/errata/RHSA-2025:1673	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=2294581	external
https://bugzilla.redhat.com/show_bug.cgi?id=2294676	external
https://bugzilla.redhat.com/show_bug.cgi?id=2301888	external
https://bugzilla.redhat.com/show_bug.cgi?id=2318857	external
https://bugzilla.redhat.com/show_bug.cgi?id=2318858	external
https://bugzilla.redhat.com/show_bug.cgi?id=2318870	external
https://bugzilla.redhat.com/show_bug.cgi?id=2318873	external
https://bugzilla.redhat.com/show_bug.cgi?id=2318874	external
https://bugzilla.redhat.com/show_bug.cgi?id=2318876	external
https://bugzilla.redhat.com/show_bug.cgi?id=2318882	external
https://bugzilla.redhat.com/show_bug.cgi?id=2318883	external
https://bugzilla.redhat.com/show_bug.cgi?id=2318884	external
https://bugzilla.redhat.com/show_bug.cgi?id=2318885	external
https://bugzilla.redhat.com/show_bug.cgi?id=2318886	external
https://bugzilla.redhat.com/show_bug.cgi?id=2318897	external
https://bugzilla.redhat.com/show_bug.cgi?id=2318900	external
https://bugzilla.redhat.com/show_bug.cgi?id=2318905	external
https://bugzilla.redhat.com/show_bug.cgi?id=2318914	external
https://bugzilla.redhat.com/show_bug.cgi?id=2318922	external
https://bugzilla.redhat.com/show_bug.cgi?id=2318923	external
https://bugzilla.redhat.com/show_bug.cgi?id=2318925	external
https://bugzilla.redhat.com/show_bug.cgi?id=2318926	external
https://bugzilla.redhat.com/show_bug.cgi?id=2318927	external
https://bugzilla.redhat.com/show_bug.cgi?id=2331191	external
https://bugzilla.redhat.com/show_bug.cgi?id=2339218	external
https://bugzilla.redhat.com/show_bug.cgi?id=2339220	external
https://bugzilla.redhat.com/show_bug.cgi?id=2339221	external
https://bugzilla.redhat.com/show_bug.cgi?id=2339226	external
https://bugzilla.redhat.com/show_bug.cgi?id=2339231	external
https://bugzilla.redhat.com/show_bug.cgi?id=2339236	external
https://bugzilla.redhat.com/show_bug.cgi?id=2339238	external
https://bugzilla.redhat.com/show_bug.cgi?id=2339243	external
https://bugzilla.redhat.com/show_bug.cgi?id=2339247	external
https://bugzilla.redhat.com/show_bug.cgi?id=2339252	external
https://bugzilla.redhat.com/show_bug.cgi?id=2339259	external
https://bugzilla.redhat.com/show_bug.cgi?id=2339266	external
https://bugzilla.redhat.com/show_bug.cgi?id=2339270	external
https://bugzilla.redhat.com/show_bug.cgi?id=2339271	external
https://bugzilla.redhat.com/show_bug.cgi?id=2339275	external
https://bugzilla.redhat.com/show_bug.cgi?id=2339277	external
https://bugzilla.redhat.com/show_bug.cgi?id=2339281	external
https://bugzilla.redhat.com/show_bug.cgi?id=2339284	external
https://bugzilla.redhat.com/show_bug.cgi?id=2339291	external
https://bugzilla.redhat.com/show_bug.cgi?id=2339293	external
https://bugzilla.redhat.com/show_bug.cgi?id=2339295	external
https://bugzilla.redhat.com/show_bug.cgi?id=2339299	external
https://bugzilla.redhat.com/show_bug.cgi?id=2339300	external
https://bugzilla.redhat.com/show_bug.cgi?id=2339304	external
https://bugzilla.redhat.com/show_bug.cgi?id=2339305	external
https://issues.redhat.com/browse/RHEL-40866	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2024-5535	self
https://bugzilla.redhat.com/show_bug.cgi?id=2294581	external
https://www.cve.org/CVERecord?id=CVE-2024-5535	external
https://nvd.nist.gov/vuln/detail/CVE-2024-5535	external
https://www.oracle.com/security-alerts/cpuoct2024…	external
https://access.redhat.com/security/cve/CVE-2024-7264	self
https://bugzilla.redhat.com/show_bug.cgi?id=2301888	external
https://www.cve.org/CVERecord?id=CVE-2024-7264	external
https://nvd.nist.gov/vuln/detail/CVE-2024-7264	external
https://access.redhat.com/security/cve/CVE-2024-11053	self
https://bugzilla.redhat.com/show_bug.cgi?id=2331191	external
https://www.cve.org/CVERecord?id=CVE-2024-11053	external
https://nvd.nist.gov/vuln/detail/CVE-2024-11053	external
https://curl.se/docs/CVE-2024-11053.html	external
https://www.oracle.com/security-alerts/cpujan2025…	external
https://access.redhat.com/security/cve/CVE-2024-21193	self
https://bugzilla.redhat.com/show_bug.cgi?id=2318923	external
https://www.cve.org/CVERecord?id=CVE-2024-21193	external
https://nvd.nist.gov/vuln/detail/CVE-2024-21193	external
https://access.redhat.com/security/cve/CVE-2024-21194	self
https://bugzilla.redhat.com/show_bug.cgi?id=2318914	external
https://www.cve.org/CVERecord?id=CVE-2024-21194	external
https://nvd.nist.gov/vuln/detail/CVE-2024-21194	external
https://access.redhat.com/security/cve/CVE-2024-21196	self
https://bugzilla.redhat.com/show_bug.cgi?id=2318858	external
https://www.cve.org/CVERecord?id=CVE-2024-21196	external
https://nvd.nist.gov/vuln/detail/CVE-2024-21196	external
https://access.redhat.com/security/cve/CVE-2024-21197	self
https://bugzilla.redhat.com/show_bug.cgi?id=2318874	external
https://www.cve.org/CVERecord?id=CVE-2024-21197	external
https://nvd.nist.gov/vuln/detail/CVE-2024-21197	external
https://access.redhat.com/security/cve/CVE-2024-21198	self
https://bugzilla.redhat.com/show_bug.cgi?id=2318925	external
https://www.cve.org/CVERecord?id=CVE-2024-21198	external
https://nvd.nist.gov/vuln/detail/CVE-2024-21198	external
https://access.redhat.com/security/cve/CVE-2024-21199	self
https://bugzilla.redhat.com/show_bug.cgi?id=2318922	external
https://www.cve.org/CVERecord?id=CVE-2024-21199	external
https://nvd.nist.gov/vuln/detail/CVE-2024-21199	external
https://access.redhat.com/security/cve/CVE-2024-21201	self
https://bugzilla.redhat.com/show_bug.cgi?id=2318882	external
https://www.cve.org/CVERecord?id=CVE-2024-21201	external
https://nvd.nist.gov/vuln/detail/CVE-2024-21201	external
https://access.redhat.com/security/cve/CVE-2024-21203	self
https://bugzilla.redhat.com/show_bug.cgi?id=2318885	external
https://www.cve.org/CVERecord?id=CVE-2024-21203	external
https://nvd.nist.gov/vuln/detail/CVE-2024-21203	external
https://access.redhat.com/security/cve/CVE-2024-21212	self
https://bugzilla.redhat.com/show_bug.cgi?id=2318886	external
https://www.cve.org/CVERecord?id=CVE-2024-21212	external
https://nvd.nist.gov/vuln/detail/CVE-2024-21212	external
https://access.redhat.com/security/cve/CVE-2024-21213	self
https://bugzilla.redhat.com/show_bug.cgi?id=2318905	external
https://www.cve.org/CVERecord?id=CVE-2024-21213	external
https://nvd.nist.gov/vuln/detail/CVE-2024-21213	external
https://access.redhat.com/security/cve/CVE-2024-21218	self
https://bugzilla.redhat.com/show_bug.cgi?id=2318876	external
https://www.cve.org/CVERecord?id=CVE-2024-21218	external
https://nvd.nist.gov/vuln/detail/CVE-2024-21218	external
https://access.redhat.com/security/cve/CVE-2024-21219	self
https://bugzilla.redhat.com/show_bug.cgi?id=2318897	external
https://www.cve.org/CVERecord?id=CVE-2024-21219	external
https://nvd.nist.gov/vuln/detail/CVE-2024-21219	external
https://access.redhat.com/security/cve/CVE-2024-21230	self
https://bugzilla.redhat.com/show_bug.cgi?id=2318900	external
https://www.cve.org/CVERecord?id=CVE-2024-21230	external
https://nvd.nist.gov/vuln/detail/CVE-2024-21230	external
https://access.redhat.com/security/cve/CVE-2024-21231	self
https://bugzilla.redhat.com/show_bug.cgi?id=2318873	external
https://www.cve.org/CVERecord?id=CVE-2024-21231	external
https://nvd.nist.gov/vuln/detail/CVE-2024-21231	external
https://access.redhat.com/security/cve/CVE-2024-21236	self
https://bugzilla.redhat.com/show_bug.cgi?id=2318883	external
https://www.cve.org/CVERecord?id=CVE-2024-21236	external
https://nvd.nist.gov/vuln/detail/CVE-2024-21236	external
https://access.redhat.com/security/cve/CVE-2024-21237	self
https://bugzilla.redhat.com/show_bug.cgi?id=2318884	external
https://www.cve.org/CVERecord?id=CVE-2024-21237	external
https://nvd.nist.gov/vuln/detail/CVE-2024-21237	external
https://access.redhat.com/security/cve/CVE-2024-21238	self
https://bugzilla.redhat.com/show_bug.cgi?id=2318857	external
https://www.cve.org/CVERecord?id=CVE-2024-21238	external
https://nvd.nist.gov/vuln/detail/CVE-2024-21238	external
https://access.redhat.com/security/cve/CVE-2024-21239	self
https://bugzilla.redhat.com/show_bug.cgi?id=2318927	external
https://www.cve.org/CVERecord?id=CVE-2024-21239	external
https://nvd.nist.gov/vuln/detail/CVE-2024-21239	external
https://access.redhat.com/security/cve/CVE-2024-21241	self
https://bugzilla.redhat.com/show_bug.cgi?id=2318870	external
https://www.cve.org/CVERecord?id=CVE-2024-21241	external
https://nvd.nist.gov/vuln/detail/CVE-2024-21241	external
https://access.redhat.com/security/cve/CVE-2024-21247	self
https://bugzilla.redhat.com/show_bug.cgi?id=2318926	external
https://www.cve.org/CVERecord?id=CVE-2024-21247	external
https://nvd.nist.gov/vuln/detail/CVE-2024-21247	external
https://access.redhat.com/security/cve/CVE-2024-37371	self
https://bugzilla.redhat.com/show_bug.cgi?id=2294676	external
https://www.cve.org/CVERecord?id=CVE-2024-37371	external
https://nvd.nist.gov/vuln/detail/CVE-2024-37371	external
https://web.mit.edu/kerberos/www/krb5-1.21/	external
https://access.redhat.com/security/cve/CVE-2025-21490	self
https://bugzilla.redhat.com/show_bug.cgi?id=2339221	external
https://www.cve.org/CVERecord?id=CVE-2025-21490	external
https://nvd.nist.gov/vuln/detail/CVE-2025-21490	external
https://access.redhat.com/security/cve/CVE-2025-21491	self
https://bugzilla.redhat.com/show_bug.cgi?id=2339252	external
https://www.cve.org/CVERecord?id=CVE-2025-21491	external
https://nvd.nist.gov/vuln/detail/CVE-2025-21491	external
https://access.redhat.com/security/cve/CVE-2025-21494	self
https://bugzilla.redhat.com/show_bug.cgi?id=2339277	external
https://www.cve.org/CVERecord?id=CVE-2025-21494	external
https://nvd.nist.gov/vuln/detail/CVE-2025-21494	external
https://access.redhat.com/security/cve/CVE-2025-21497	self
https://bugzilla.redhat.com/show_bug.cgi?id=2339218	external
https://www.cve.org/CVERecord?id=CVE-2025-21497	external
https://nvd.nist.gov/vuln/detail/CVE-2025-21497	external
https://access.redhat.com/security/cve/CVE-2025-21500	self
https://bugzilla.redhat.com/show_bug.cgi?id=2339300	external
https://www.cve.org/CVERecord?id=CVE-2025-21500	external
https://nvd.nist.gov/vuln/detail/CVE-2025-21500	external
https://access.redhat.com/security/cve/CVE-2025-21501	self
https://bugzilla.redhat.com/show_bug.cgi?id=2339271	external
https://www.cve.org/CVERecord?id=CVE-2025-21501	external
https://nvd.nist.gov/vuln/detail/CVE-2025-21501	external
https://access.redhat.com/security/cve/CVE-2025-21503	self
https://bugzilla.redhat.com/show_bug.cgi?id=2339291	external
https://www.cve.org/CVERecord?id=CVE-2025-21503	external
https://nvd.nist.gov/vuln/detail/CVE-2025-21503	external
https://access.redhat.com/security/cve/CVE-2025-21504	self
https://bugzilla.redhat.com/show_bug.cgi?id=2339236	external
https://www.cve.org/CVERecord?id=CVE-2025-21504	external
https://nvd.nist.gov/vuln/detail/CVE-2025-21504	external
https://access.redhat.com/security/cve/CVE-2025-21505	self
https://bugzilla.redhat.com/show_bug.cgi?id=2339305	external
https://www.cve.org/CVERecord?id=CVE-2025-21505	external
https://nvd.nist.gov/vuln/detail/CVE-2025-21505	external
https://access.redhat.com/security/cve/CVE-2025-21518	self
https://bugzilla.redhat.com/show_bug.cgi?id=2339293	external
https://www.cve.org/CVERecord?id=CVE-2025-21518	external
https://nvd.nist.gov/vuln/detail/CVE-2025-21518	external
https://access.redhat.com/security/cve/CVE-2025-21519	self
https://bugzilla.redhat.com/show_bug.cgi?id=2339281	external
https://www.cve.org/CVERecord?id=CVE-2025-21519	external
https://nvd.nist.gov/vuln/detail/CVE-2025-21519	external
https://access.redhat.com/security/cve/CVE-2025-21520	self
https://bugzilla.redhat.com/show_bug.cgi?id=2339220	external
https://www.cve.org/CVERecord?id=CVE-2025-21520	external
https://nvd.nist.gov/vuln/detail/CVE-2025-21520	external
https://access.redhat.com/security/cve/CVE-2025-21521	self
https://bugzilla.redhat.com/show_bug.cgi?id=2339270	external
https://www.cve.org/CVERecord?id=CVE-2025-21521	external
https://nvd.nist.gov/vuln/detail/CVE-2025-21521	external
https://access.redhat.com/security/cve/CVE-2025-21522	self
https://bugzilla.redhat.com/show_bug.cgi?id=2339284	external
https://www.cve.org/CVERecord?id=CVE-2025-21522	external
https://nvd.nist.gov/vuln/detail/CVE-2025-21522	external
https://access.redhat.com/security/cve/CVE-2025-21523	self
https://bugzilla.redhat.com/show_bug.cgi?id=2339304	external
https://www.cve.org/CVERecord?id=CVE-2025-21523	external
https://nvd.nist.gov/vuln/detail/CVE-2025-21523	external
https://access.redhat.com/security/cve/CVE-2025-21525	self
https://bugzilla.redhat.com/show_bug.cgi?id=2339259	external
https://www.cve.org/CVERecord?id=CVE-2025-21525	external
https://nvd.nist.gov/vuln/detail/CVE-2025-21525	external
https://access.redhat.com/security/cve/CVE-2025-21529	self
https://bugzilla.redhat.com/show_bug.cgi?id=2339226	external
https://www.cve.org/CVERecord?id=CVE-2025-21529	external
https://nvd.nist.gov/vuln/detail/CVE-2025-21529	external
https://access.redhat.com/security/cve/CVE-2025-21531	self
https://bugzilla.redhat.com/show_bug.cgi?id=2339231	external
https://www.cve.org/CVERecord?id=CVE-2025-21531	external
https://nvd.nist.gov/vuln/detail/CVE-2025-21531	external
https://access.redhat.com/security/cve/CVE-2025-21534	self
https://bugzilla.redhat.com/show_bug.cgi?id=2339275	external
https://www.cve.org/CVERecord?id=CVE-2025-21534	external
https://nvd.nist.gov/vuln/detail/CVE-2025-21534	external
https://access.redhat.com/security/cve/CVE-2025-21536	self
https://bugzilla.redhat.com/show_bug.cgi?id=2339266	external
https://www.cve.org/CVERecord?id=CVE-2025-21536	external
https://nvd.nist.gov/vuln/detail/CVE-2025-21536	external
https://access.redhat.com/security/cve/CVE-2025-21540	self
https://bugzilla.redhat.com/show_bug.cgi?id=2339238	external
https://www.cve.org/CVERecord?id=CVE-2025-21540	external
https://nvd.nist.gov/vuln/detail/CVE-2025-21540	external
https://access.redhat.com/security/cve/CVE-2025-21543	self
https://bugzilla.redhat.com/show_bug.cgi?id=2339247	external
https://www.cve.org/CVERecord?id=CVE-2025-21543	external
https://nvd.nist.gov/vuln/detail/CVE-2025-21543	external
https://access.redhat.com/security/cve/CVE-2025-21546	self
https://bugzilla.redhat.com/show_bug.cgi?id=2339299	external
https://www.cve.org/CVERecord?id=CVE-2025-21546	external
https://nvd.nist.gov/vuln/detail/CVE-2025-21546	external
https://access.redhat.com/security/cve/CVE-2025-21555	self
https://bugzilla.redhat.com/show_bug.cgi?id=2339243	external
https://www.cve.org/CVERecord?id=CVE-2025-21555	external
https://nvd.nist.gov/vuln/detail/CVE-2025-21555	external
https://access.redhat.com/security/cve/CVE-2025-21559	self
https://bugzilla.redhat.com/show_bug.cgi?id=2339295	external
https://www.cve.org/CVERecord?id=CVE-2025-21559	external
https://nvd.nist.gov/vuln/detail/CVE-2025-21559	external

JSON

To clipboard

Loading 1.9 MB of JSON…

CVE-2024-21213 (GCVE-0-2024-21213)

Vulnerability from cvelistv5 – Published: 2024-10-15 19:52 – Updated: 2025-11-03 21:53

Summary

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and 9.0.1 and prior. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.2 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H).

Severity

4.2 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-10-16 14:36 UTC

CWE

Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.
CWE-noinfo Not enough information

Assigner

oracle mitre root

References

2 references

URL	Tags
https://www.oracle.com/security-alerts/cpuoct2024.html	vendor-advisory
https://security.netapp.com/advisory/ntap-2024102…

Impacted products

1 product

Vendor	Product	Version
Oracle Corporation	MySQL Server	Affected: * , ≤ 8.0.39 (custom) Affected: * , ≤ 8.4.2 (custom) Affected: * , ≤ 9.0.1 (custom) cpe:2.3:a:oracle:mysql_server:8.0.39_and_prior:::::::* cpe:2.3:a:oracle:mysql_server:8.4.2_and_prior:::::::* cpe:2.3:a:oracle:mysql_server:9.0.1_and_prior:::::::*

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-21213",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-16T14:36:32.280194Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-25T16:38:35.492Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T21:53:01.413Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://security.netapp.com/advisory/ntap-20241025-0006/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:oracle:mysql_server:8.0.39_and_prior:*:*:*:*:*:*:*",
            "cpe:2.3:a:oracle:mysql_server:8.4.2_and_prior:*:*:*:*:*:*:*",
            "cpe:2.3:a:oracle:mysql_server:9.0.1_and_prior:*:*:*:*:*:*:*"
          ],
          "product": "MySQL Server",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "lessThanOrEqual": "8.0.39",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "8.4.2",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "9.0.1",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and  9.0.1 and prior. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.2 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 4.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.",
              "lang": "en-US"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-10-15T19:52:42.559Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "Oracle Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2024.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2024-21213",
    "datePublished": "2024-10-15T19:52:42.559Z",
    "dateReserved": "2023-12-07T22:28:10.690Z",
    "dateUpdated": "2025-11-03T21:53:01.413Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-21218 (GCVE-0-2024-21218)

Vulnerability from cvelistv5 – Published: 2024-10-15 19:52 – Updated: 2025-11-03 21:53

Summary

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and 9.0.1 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

Severity

4.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-10-17 13:44 UTC

CWE

Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Cluster.
CWE-400 - Uncontrolled Resource Consumption

Assigner

oracle mitre root

References

2 references

URL	Tags
https://www.oracle.com/security-alerts/cpuoct2024.html	vendor-advisory
https://security.netapp.com/advisory/ntap-2024102…

Impacted products

2 products

Vendor	Product	Version
Oracle Corporation	MySQL Cluster	Affected: * , ≤ 7.5.35 (custom) Affected: * , ≤ 7.6.31 (custom) Affected: * , ≤ 8.0.39 (custom) Affected: * , ≤ 8.4.2 (custom) Affected: * , ≤ 9.0.1 (custom) cpe:2.3:a:oracle:mysql_cluster:7.5.35_and_prior:::::::* cpe:2.3:a:oracle:mysql_cluster:7.6.31_and_prior:::::::* cpe:2.3:a:oracle:mysql_cluster:8.0.39_and_prior:::::::* cpe:2.3:a:oracle:mysql_cluster:8.4.2_and_prior:::::::* cpe:2.3:a:oracle:mysql_cluster:9.0.1_and_prior:::::::*
Oracle Corporation	MySQL Server	Affected: * , ≤ 8.0.39 (custom) Affected: * , ≤ 8.4.2 (custom) Affected: * , ≤ 9.0.1 (custom) cpe:2.3:a:oracle:mysql_server:8.0.39_and_prior:::::::* cpe:2.3:a:oracle:mysql_server:8.4.2_and_prior:::::::* cpe:2.3:a:oracle:mysql_server:9.0.1_and_prior:::::::*

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-21218",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-17T13:44:06.112045Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-400",
                "description": "CWE-400 Uncontrolled Resource Consumption",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-13T15:35:27.998Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T21:53:05.825Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://security.netapp.com/advisory/ntap-20241025-0006/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:oracle:mysql_cluster:7.5.35_and_prior:*:*:*:*:*:*:*",
            "cpe:2.3:a:oracle:mysql_cluster:7.6.31_and_prior:*:*:*:*:*:*:*",
            "cpe:2.3:a:oracle:mysql_cluster:8.0.39_and_prior:*:*:*:*:*:*:*",
            "cpe:2.3:a:oracle:mysql_cluster:8.4.2_and_prior:*:*:*:*:*:*:*",
            "cpe:2.3:a:oracle:mysql_cluster:9.0.1_and_prior:*:*:*:*:*:*:*"
          ],
          "product": "MySQL Cluster",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "lessThanOrEqual": "7.5.35",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "7.6.31",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "8.0.39",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "8.4.2",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "9.0.1",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:oracle:mysql_server:8.0.39_and_prior:*:*:*:*:*:*:*",
            "cpe:2.3:a:oracle:mysql_server:8.4.2_and_prior:*:*:*:*:*:*:*",
            "cpe:2.3:a:oracle:mysql_server:9.0.1_and_prior:*:*:*:*:*:*:*"
          ],
          "product": "MySQL Server",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "lessThanOrEqual": "8.0.39",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "8.4.2",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "9.0.1",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and  9.0.1 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Cluster.",
              "lang": "en-US"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-10-15T19:52:44.128Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "Oracle Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2024.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2024-21218",
    "datePublished": "2024-10-15T19:52:44.128Z",
    "dateReserved": "2023-12-07T22:28:10.691Z",
    "dateUpdated": "2025-11-03T21:53:05.825Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-21219 (GCVE-0-2024-21219)

Vulnerability from cvelistv5 – Published: 2024-10-15 19:52 – Updated: 2025-11-03 21:53

Summary

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and 9.0.1 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

Severity

4.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-10-17 13:43 UTC

CWE

Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.
CWE-400 - Uncontrolled Resource Consumption

Assigner

oracle mitre root

References

2 references

URL	Tags
https://www.oracle.com/security-alerts/cpuoct2024.html	vendor-advisory
https://security.netapp.com/advisory/ntap-2024102…

Impacted products

1 product

Vendor	Product	Version
Oracle Corporation	MySQL Server	Affected: * , ≤ 8.0.39 (custom) Affected: * , ≤ 8.4.2 (custom) Affected: * , ≤ 9.0.1 (custom) cpe:2.3:a:oracle:mysql_server:8.0.39_and_prior:::::::* cpe:2.3:a:oracle:mysql_server:8.4.2_and_prior:::::::* cpe:2.3:a:oracle:mysql_server:9.0.1_and_prior:::::::*

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-21219",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-17T13:43:46.388365Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-400",
                "description": "CWE-400 Uncontrolled Resource Consumption",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-13T15:51:42.145Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T21:53:07.283Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://security.netapp.com/advisory/ntap-20241025-0006/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:oracle:mysql_server:8.0.39_and_prior:*:*:*:*:*:*:*",
            "cpe:2.3:a:oracle:mysql_server:8.4.2_and_prior:*:*:*:*:*:*:*",
            "cpe:2.3:a:oracle:mysql_server:9.0.1_and_prior:*:*:*:*:*:*:*"
          ],
          "product": "MySQL Server",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "lessThanOrEqual": "8.0.39",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "8.4.2",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "9.0.1",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML).  Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and  9.0.1 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.",
              "lang": "en-US"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-10-15T19:52:44.460Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "Oracle Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2024.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2024-21219",
    "datePublished": "2024-10-15T19:52:44.460Z",
    "dateReserved": "2023-12-07T22:28:10.691Z",
    "dateUpdated": "2025-11-03T21:53:07.283Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-21230 (GCVE-0-2024-21230)

Vulnerability from cvelistv5 – Published: 2024-10-15 19:52 – Updated: 2025-11-03 21:53

Summary

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and 9.0.1 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-10-17 13:43 UTC

CWE

Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Cluster.
CWE-400 - Uncontrolled Resource Consumption

Assigner

oracle mitre root

References

2 references

URL	Tags
https://www.oracle.com/security-alerts/cpuoct2024.html	vendor-advisory
https://security.netapp.com/advisory/ntap-2024102…

Impacted products

2 products

Vendor	Product	Version
Oracle Corporation	MySQL Cluster	Affected: * , ≤ 7.5.35 (custom) Affected: * , ≤ 7.6.31 (custom) Affected: * , ≤ 8.0.39 (custom) Affected: * , ≤ 8.4.2 (custom) Affected: * , ≤ 9.0.1 (custom) cpe:2.3:a:oracle:mysql_cluster:7.5.35_and_prior:::::::* cpe:2.3:a:oracle:mysql_cluster:7.6.31_and_prior:::::::* cpe:2.3:a:oracle:mysql_cluster:8.0.39_and_prior:::::::* cpe:2.3:a:oracle:mysql_cluster:8.4.2_and_prior:::::::* cpe:2.3:a:oracle:mysql_cluster:9.0.1_and_prior:::::::*
Oracle Corporation	MySQL Server	Affected: * , ≤ 8.0.39 (custom) Affected: * , ≤ 8.4.2 (custom) Affected: * , ≤ 9.0.1 (custom) cpe:2.3:a:oracle:mysql_server:8.0.39_and_prior:::::::* cpe:2.3:a:oracle:mysql_server:8.4.2_and_prior:::::::* cpe:2.3:a:oracle:mysql_server:9.0.1_and_prior:::::::*

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-21230",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-17T13:43:08.519772Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-400",
                "description": "CWE-400 Uncontrolled Resource Consumption",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-13T15:25:45.161Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T21:53:08.748Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://security.netapp.com/advisory/ntap-20241025-0006/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:oracle:mysql_cluster:7.5.35_and_prior:*:*:*:*:*:*:*",
            "cpe:2.3:a:oracle:mysql_cluster:7.6.31_and_prior:*:*:*:*:*:*:*",
            "cpe:2.3:a:oracle:mysql_cluster:8.0.39_and_prior:*:*:*:*:*:*:*",
            "cpe:2.3:a:oracle:mysql_cluster:8.4.2_and_prior:*:*:*:*:*:*:*",
            "cpe:2.3:a:oracle:mysql_cluster:9.0.1_and_prior:*:*:*:*:*:*:*"
          ],
          "product": "MySQL Cluster",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "lessThanOrEqual": "7.5.35",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "7.6.31",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "8.0.39",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "8.4.2",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "9.0.1",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:oracle:mysql_server:8.0.39_and_prior:*:*:*:*:*:*:*",
            "cpe:2.3:a:oracle:mysql_server:8.4.2_and_prior:*:*:*:*:*:*:*",
            "cpe:2.3:a:oracle:mysql_server:9.0.1_and_prior:*:*:*:*:*:*:*"
          ],
          "product": "MySQL Server",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "lessThanOrEqual": "8.0.39",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "8.4.2",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "9.0.1",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and  9.0.1 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Cluster.",
              "lang": "en-US"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-10-15T19:52:45.238Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "Oracle Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2024.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2024-21230",
    "datePublished": "2024-10-15T19:52:45.238Z",
    "dateReserved": "2023-12-07T22:28:10.693Z",
    "dateUpdated": "2025-11-03T21:53:08.748Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-21231 (GCVE-0-2024-21231)

Vulnerability from cvelistv5 – Published: 2024-10-15 19:52 – Updated: 2025-11-03 21:53

Summary

Severity

3.1 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-10-17 13:42 UTC

CWE

Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server.
CWE-400 - Uncontrolled Resource Consumption

Assigner

oracle mitre root

References

2 references

URL	Tags
https://www.oracle.com/security-alerts/cpuoct2024.html	vendor-advisory
https://security.netapp.com/advisory/ntap-2024102…

Impacted products

1 product

Vendor	Product	Version
Oracle Corporation	MySQL Server	Affected: * , ≤ 8.0.39 (custom) Affected: * , ≤ 8.4.2 (custom) Affected: * , ≤ 9.0.1 (custom) cpe:2.3:a:oracle:mysql_server:8.0.39_and_prior:::::::* cpe:2.3:a:oracle:mysql_server:8.4.2_and_prior:::::::* cpe:2.3:a:oracle:mysql_server:9.0.1_and_prior:::::::*

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-21231",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-17T13:42:42.853283Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-400",
                "description": "CWE-400 Uncontrolled Resource Consumption",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-13T13:33:32.263Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T21:53:10.198Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://security.netapp.com/advisory/ntap-20241025-0006/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:oracle:mysql_server:8.0.39_and_prior:*:*:*:*:*:*:*",
            "cpe:2.3:a:oracle:mysql_server:8.4.2_and_prior:*:*:*:*:*:*:*",
            "cpe:2.3:a:oracle:mysql_server:9.0.1_and_prior:*:*:*:*:*:*:*"
          ],
          "product": "MySQL Server",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "lessThanOrEqual": "8.0.39",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "8.4.2",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "9.0.1",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Vulnerability in the MySQL Server product of Oracle MySQL (component: Client programs).  Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and  9.0.1 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server. CVSS 3.1 Base Score 3.1 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server.",
              "lang": "en-US"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-10-15T19:52:45.633Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "Oracle Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2024.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2024-21231",
    "datePublished": "2024-10-15T19:52:45.633Z",
    "dateReserved": "2023-12-07T22:28:10.694Z",
    "dateUpdated": "2025-11-03T21:53:10.198Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-21236 (GCVE-0-2024-21236)

Vulnerability from cvelistv5 – Published: 2024-10-15 19:52 – Updated: 2025-11-03 21:53

Summary

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and 9.0.1 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

Severity

4.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-10-16 14:29 UTC

CWE

Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.
CWE-noinfo Not enough information

Assigner

oracle mitre root

References

2 references

URL	Tags
https://www.oracle.com/security-alerts/cpuoct2024.html	vendor-advisory
https://security.netapp.com/advisory/ntap-2024102…

Impacted products

1 product

Vendor	Product	Version
Oracle Corporation	MySQL Server	Affected: * , ≤ 8.0.39 (custom) Affected: * , ≤ 8.4.2 (custom) Affected: * , ≤ 9.0.1 (custom) cpe:2.3:a:oracle:mysql_server:8.0.39_and_prior:::::::* cpe:2.3:a:oracle:mysql_server:8.4.2_and_prior:::::::* cpe:2.3:a:oracle:mysql_server:9.0.1_and_prior:::::::*

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-21236",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-16T14:29:46.434475Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-25T15:49:38.118Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T21:53:16.093Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://security.netapp.com/advisory/ntap-20241025-0006/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:oracle:mysql_server:8.0.39_and_prior:*:*:*:*:*:*:*",
            "cpe:2.3:a:oracle:mysql_server:8.4.2_and_prior:*:*:*:*:*:*:*",
            "cpe:2.3:a:oracle:mysql_server:9.0.1_and_prior:*:*:*:*:*:*:*"
          ],
          "product": "MySQL Server",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "lessThanOrEqual": "8.0.39",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "8.4.2",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "9.0.1",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and  9.0.1 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.",
              "lang": "en-US"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-10-15T19:52:47.226Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "Oracle Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2024.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2024-21236",
    "datePublished": "2024-10-15T19:52:47.226Z",
    "dateReserved": "2023-12-07T22:28:10.698Z",
    "dateUpdated": "2025-11-03T21:53:16.093Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-21237 (GCVE-0-2024-21237)

Vulnerability from cvelistv5 – Published: 2024-10-15 19:52 – Updated: 2025-11-03 21:53

Summary

Severity

2.2 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-10-16 14:28 UTC

CWE

Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server.
CWE-noinfo Not enough information

Assigner

oracle mitre root

References

2 references

URL	Tags
https://www.oracle.com/security-alerts/cpuoct2024.html	vendor-advisory
https://security.netapp.com/advisory/ntap-2024102…

Impacted products

1 product

Vendor	Product	Version
Oracle Corporation	MySQL Server	Affected: * , ≤ 8.0.39 (custom) Affected: * , ≤ 8.4.2 (custom) Affected: * , ≤ 9.0.1 (custom) cpe:2.3:a:oracle:mysql_server:8.0.39_and_prior:::::::* cpe:2.3:a:oracle:mysql_server:8.4.2_and_prior:::::::* cpe:2.3:a:oracle:mysql_server:9.0.1_and_prior:::::::*

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-21237",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-16T14:28:58.342571Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-25T16:01:38.517Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T21:53:17.543Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://security.netapp.com/advisory/ntap-20241025-0006/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:oracle:mysql_server:8.0.39_and_prior:*:*:*:*:*:*:*",
            "cpe:2.3:a:oracle:mysql_server:8.4.2_and_prior:*:*:*:*:*:*:*",
            "cpe:2.3:a:oracle:mysql_server:9.0.1_and_prior:*:*:*:*:*:*:*"
          ],
          "product": "MySQL Server",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "lessThanOrEqual": "8.0.39",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "8.4.2",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "9.0.1",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Group Replication GCS).  Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and  9.0.1 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server. CVSS 3.1 Base Score 2.2 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 2.2,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server.",
              "lang": "en-US"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-10-15T19:52:47.598Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "Oracle Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2024.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2024-21237",
    "datePublished": "2024-10-15T19:52:47.598Z",
    "dateReserved": "2023-12-07T22:28:10.698Z",
    "dateUpdated": "2025-11-03T21:53:17.543Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-21238 (GCVE-0-2024-21238)

Vulnerability from cvelistv5 – Published: 2024-10-15 19:52 – Updated: 2025-03-25 16:48

Summary

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Thread Pooling). Supported versions that are affected are 8.0.39 and prior, 8.4.1 and prior and 9.0.1 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H).

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-10-16 14:28 UTC

CWE

Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Cluster.
CWE-noinfo Not enough information

Assigner

oracle mitre root

References

2 references

URL	Tags
https://www.oracle.com/security-alerts/cpuoct2024.html	vendor-advisory
https://security.netapp.com/advisory/ntap-2024102…

Impacted products

2 products

Vendor	Product	Version
Oracle Corporation	MySQL Cluster	Affected: * , ≤ 7.5.35 (custom) Affected: * , ≤ 7.6.31 (custom) Affected: * , ≤ 8.0.39 (custom) Affected: * , ≤ 8.4.2 (custom) Affected: * , ≤ 9.0.1 (custom) cpe:2.3:a:oracle:mysql_cluster:7.5.35_and_prior:::::::* cpe:2.3:a:oracle:mysql_cluster:7.6.31_and_prior:::::::* cpe:2.3:a:oracle:mysql_cluster:8.0.39_and_prior:::::::* cpe:2.3:a:oracle:mysql_cluster:8.4.2_and_prior:::::::* cpe:2.3:a:oracle:mysql_cluster:9.0.1_and_prior:::::::*
Oracle Corporation	MySQL Server	Affected: * , ≤ 8.0.39 (custom) Affected: * , ≤ 8.4.1 (custom) Affected: * , ≤ 9.0.1 (custom) cpe:2.3:a:oracle:mysql_server:8.0.39_and_prior:::::::* cpe:2.3:a:oracle:mysql_server:8.4.1_and_prior:::::::* cpe:2.3:a:oracle:mysql_server:9.0.1_and_prior:::::::*

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-21238",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-16T14:28:18.316170Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-25T16:48:38.704Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-10-25T13:07:34.656Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://security.netapp.com/advisory/ntap-20241025-0009/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:oracle:mysql_cluster:7.5.35_and_prior:*:*:*:*:*:*:*",
            "cpe:2.3:a:oracle:mysql_cluster:7.6.31_and_prior:*:*:*:*:*:*:*",
            "cpe:2.3:a:oracle:mysql_cluster:8.0.39_and_prior:*:*:*:*:*:*:*",
            "cpe:2.3:a:oracle:mysql_cluster:8.4.2_and_prior:*:*:*:*:*:*:*",
            "cpe:2.3:a:oracle:mysql_cluster:9.0.1_and_prior:*:*:*:*:*:*:*"
          ],
          "product": "MySQL Cluster",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "lessThanOrEqual": "7.5.35",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "7.6.31",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "8.0.39",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "8.4.2",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "9.0.1",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:oracle:mysql_server:8.0.39_and_prior:*:*:*:*:*:*:*",
            "cpe:2.3:a:oracle:mysql_server:8.4.1_and_prior:*:*:*:*:*:*:*",
            "cpe:2.3:a:oracle:mysql_server:9.0.1_and_prior:*:*:*:*:*:*:*"
          ],
          "product": "MySQL Server",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "lessThanOrEqual": "8.0.39",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "8.4.1",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "9.0.1",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Thread Pooling).  Supported versions that are affected are 8.0.39 and prior, 8.4.1 and prior and  9.0.1 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 5.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Cluster.",
              "lang": "en-US"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-10-15T19:52:47.971Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "Oracle Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2024.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2024-21238",
    "datePublished": "2024-10-15T19:52:47.971Z",
    "dateReserved": "2023-12-07T22:28:10.698Z",
    "dateUpdated": "2025-03-25T16:48:38.704Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-21239 (GCVE-0-2024-21239)

Vulnerability from cvelistv5 – Published: 2024-10-15 19:52 – Updated: 2025-11-03 21:53

Summary

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and 9.0.1 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

Severity

4.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-10-16 14:26 UTC

CWE

Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.
CWE-noinfo Not enough information

Assigner

oracle mitre root

References

2 references

URL	Tags
https://www.oracle.com/security-alerts/cpuoct2024.html	vendor-advisory
https://security.netapp.com/advisory/ntap-2024102…

Impacted products

1 product

Vendor	Product	Version
Oracle Corporation	MySQL Server	Affected: * , ≤ 8.0.39 (custom) Affected: * , ≤ 8.4.2 (custom) Affected: * , ≤ 9.0.1 (custom) cpe:2.3:a:oracle:mysql_server:8.0.39_and_prior:::::::* cpe:2.3:a:oracle:mysql_server:8.4.2_and_prior:::::::* cpe:2.3:a:oracle:mysql_server:9.0.1_and_prior:::::::*

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-21239",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-16T14:26:58.371049Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-25T16:53:41.987Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T21:53:19.000Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://security.netapp.com/advisory/ntap-20241025-0006/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:oracle:mysql_server:8.0.39_and_prior:*:*:*:*:*:*:*",
            "cpe:2.3:a:oracle:mysql_server:8.4.2_and_prior:*:*:*:*:*:*:*",
            "cpe:2.3:a:oracle:mysql_server:9.0.1_and_prior:*:*:*:*:*:*:*"
          ],
          "product": "MySQL Server",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "lessThanOrEqual": "8.0.39",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "8.4.2",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "9.0.1",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and  9.0.1 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.",
              "lang": "en-US"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-10-15T19:52:48.332Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "Oracle Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2024.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2024-21239",
    "datePublished": "2024-10-15T19:52:48.332Z",
    "dateReserved": "2023-12-07T22:28:10.698Z",
    "dateUpdated": "2025-11-03T21:53:19.000Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-21241 (GCVE-0-2024-21241)

Vulnerability from cvelistv5 – Published: 2024-10-15 19:52 – Updated: 2025-11-03 21:53

Summary

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and 9.0.1 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

Severity

4.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-10-16 14:26 UTC

CWE

Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.
CWE-noinfo Not enough information

Assigner

oracle mitre root

References

2 references

URL	Tags
https://www.oracle.com/security-alerts/cpuoct2024.html	vendor-advisory
https://security.netapp.com/advisory/ntap-2024102…

Impacted products

1 product

Vendor	Product	Version
Oracle Corporation	MySQL Server	Affected: * , ≤ 8.0.39 (custom) Affected: * , ≤ 8.4.2 (custom) Affected: * , ≤ 9.0.1 (custom) cpe:2.3:a:oracle:mysql_server:8.0.39_and_prior:::::::* cpe:2.3:a:oracle:mysql_server:8.4.2_and_prior:::::::* cpe:2.3:a:oracle:mysql_server:9.0.1_and_prior:::::::*

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-21241",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-16T14:26:02.823378Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-25T15:50:44.842Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T21:53:20.461Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://security.netapp.com/advisory/ntap-20241025-0006/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:oracle:mysql_server:8.0.39_and_prior:*:*:*:*:*:*:*",
            "cpe:2.3:a:oracle:mysql_server:8.4.2_and_prior:*:*:*:*:*:*:*",
            "cpe:2.3:a:oracle:mysql_server:9.0.1_and_prior:*:*:*:*:*:*:*"
          ],
          "product": "MySQL Server",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "lessThanOrEqual": "8.0.39",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "8.4.2",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "9.0.1",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and  9.0.1 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.",
              "lang": "en-US"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-10-15T19:52:48.644Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "Oracle Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2024.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2024-21241",
    "datePublished": "2024-10-15T19:52:48.644Z",
    "dateReserved": "2023-12-07T22:28:10.699Z",
    "dateUpdated": "2025-11-03T21:53:20.461Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

RHSA-2025:1673

CVE-2024-21213 (GCVE-0-2024-21213)

CVE-2024-21218 (GCVE-0-2024-21218)

CVE-2024-21219 (GCVE-0-2024-21219)

CVE-2024-21230 (GCVE-0-2024-21230)

CVE-2024-21231 (GCVE-0-2024-21231)

CVE-2024-21236 (GCVE-0-2024-21236)

CVE-2024-21237 (GCVE-0-2024-21237)

CVE-2024-21238 (GCVE-0-2024-21238)

CVE-2024-21239 (GCVE-0-2024-21239)

CVE-2024-21241 (GCVE-0-2024-21241)

Tags

Sightings

Nomenclature