Red Hat Security Advisory

RHSA-2022:1556

mariadb:10.3 security and bug fix update

Released 2022-04-26 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 8) Judy-1.0.5-18.module+el8+2765+cfa4f87b.aarch64::mariadb:10.3, Judy-1.0.5-18.module+el8+2765+cfa4f87b.ppc64le::mariadb:10.3, Judy-1.0.5-18.module+el8+2765+cfa4f87b.s390x::mariadb:10.3 +47

Fixes 14 records

TI-2021-02058 CVE-2021-2389 · GHSA-xrfh-762q-x6xj

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).

LOW 37

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.08149 Published 2021-07-20 Partial fix

TI-2022-10441 CVE-2022-27385 · GHSA-m469-6q82-xqvx

An issue in the component Used_tables_and_const_cache::used_tables_and_const_cache_join…

LOW 36

An issue in the component Used_tables_and_const_cache::used_tables_and_const_cache_join of MariaDB Server v10.7 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL sta…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01658 Published 2022-04-12 Partial fix CWE-89

TI-2021-14329 CVE-2021-35604 · GHSA-c9rm-w869-vhx6

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).

LOW 30

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).

CVSS 3.1MEDIUM 5.5 Network High privileges No interaction EPSS 0.02662 Published 2021-10-20 Partial fix

TI-2021-01844 CVE-2021-2166 · GHSA-9pgh-f42j-q89p

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML).

LOW 30

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML).

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.04909 Published 2021-04-22 Partial fix

TI-2021-01833 CVE-2021-2154 · GHSA-c827-7w49-pg8j

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML).

LOW 27

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML).

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.02603 Published 2021-04-22 Partial fix

TI-2021-02042 CVE-2021-2372 · GHSA-phcf-v7xh-g74h

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).

LOW 26

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).

CVSS 3.1MEDIUM 4.4 Network High privileges No interaction EPSS 0.03029 Published 2021-07-20 Partial fix

TI-2021-21439 CVE-2021-46667 · GHSA-f3hf-23j8-mwgw

MariaDB before 10.6.5 has a sql_lex.cc integer overflow, leading to an application crash.

LOW 25

MariaDB before 10.6.5 has a sql_lex.cc integer overflow, leading to an application crash.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00425 Published 2022-02-01 Partial fix CWE-190

TI-2021-21438 CVE-2021-46666 · GHSA-qhvg-j82m-w264

MariaDB before 10.6.2 allows an application crash because of mishandling of a pushdown…

LOW 25

MariaDB before 10.6.2 allows an application crash because of mishandling of a pushdown from a HAVING clause to a WHERE clause.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00391 Published 2022-02-01 Partial fix CWE-617

TI-2021-21434 CVE-2021-46662 · GHSA-p388-7w8m-f48h

MariaDB through 10.5.9 allows a set_var.cc application crash via certain uses of an…

LOW 25

MariaDB through 10.5.9 allows a set_var.cc application crash via certain uses of an UPDATE statement in conjunction with a nested subquery.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00391 Published 2022-02-01 Partial fix

TI-2021-21430 CVE-2021-46658 · GHSA-2vgr-c24v-3xf3

save_window_function_values in MariaDB before 10.6.3 allows an application crash because…

LOW 25

save_window_function_values in MariaDB before 10.6.3 allows an application crash because of incorrect handling of with_window_func=true for a subquery.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00387 Published 2022-01-29 Partial fix

TI-2021-21429 CVE-2021-46657 · GHSA-3qqv-wmpg-38v7

get_sort_by_table in MariaDB before 10.6.2 allows an application crash via certain subquery uses of ORDER BY.

LOW 25

get_sort_by_table in MariaDB before 10.6.2 allows an application crash via certain subquery uses of ORDER BY.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.0039 Published 2022-01-29 Partial fix

TI-2022-13548 CVE-2022-31624 · GHSA-qcq9-cqmp-6vr3

MariaDB Server before 10.7 is vulnerable to Denial of Service.

LOW 24

MariaDB Server before 10.7 is vulnerable to Denial of Service.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00216 Published 2022-05-25 Partial fix CWE-667

TI-2022-13545 CVE-2022-31621 · GHSA-vx82-3vmh-hc4q

MariaDB Server before 10.7 is vulnerable to Denial of Service.

LOW 24

MariaDB Server before 10.7 is vulnerable to Denial of Service.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00223 Published 2022-05-25 Partial fix CWE-667

TI-2022-05836 CVE-2022-21451 · GHSA-3crw-xq5c-jr37

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).

LOW 23

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).

CVSS 3.1MEDIUM 4.4 Network High privileges No interaction EPSS 0.01232 Published 2022-04-19 Partial fix