Red Hat Security Advisory

RHSA-2025:1671

mysql security update

Released 2025-02-19 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat CodeReady Linux Builder (v. 9) mysql-devel-8.0.41-2.el9_5, mysql-libs-8.0.41-2.el9_5, mysql-test-8.0.41-2.el9_5
Red Hat Enterprise Linux AppStream (v. 9) mysql-8.0.41-2.el9_5, mysql-common-8.0.41-2.el9_5, mysql-errmsg-8.0.41-2.el9_5 +1

Fixes 49 records

TI-2024-05145 CVE-2024-5535 · GHSA-4fc7-mvrr-wv2c

SSL_select_next_proto buffer overread

MEDIUM 54

Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an empty supported client protocols buffer may cause a crash or memory contents to be sent to the peer.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.05582 Published 2024-06-27 Partial fix · 3.3.2, 3.2.3 +4 CWE-125

TI-2024-10241 CVE-2024-11053 · GHSA-h288-5fq8-5pfw

netrc and redirect credential leak

MEDIUM 50

When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances.

CVSS 3.1LOW 3.4 Network No auth User interaction EPSS 0.01966 Published 2024-12-11 Partial fix

TI-2024-06729 CVE-2024-7264 · GHSA-97c4-2w4v-c7r8

ASN.1 date parser overread

MEDIUM 48

libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an ASN.1 Generalized Time field.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.20217 Published 2024-07-31 Partial fix CWE-125

TI-2024-24881 CVE-2024-37371 · GHSA-8wpj-v5qv-3wf4

In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can cause invalid memory reads…

MEDIUM 43

In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can cause invalid memory reads during GSS message token handling by sending message tokens with invalid length fields.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.01863 Published 2024-06-28 Partial fix CWE-125

TI-2025-15481 CVE-2025-21521 · GHSA-2rgw-wmwq-m2w3

Resource allocation without limits in Oracle MySQL Server

MEDIUM 41

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Thread Pooling).

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01104 Published 2025-01-21 Fixed CWE-770

TI-2025-15482 CVE-2025-21522 · GHSA-r5hv-f8cp-qm5f

Resource allocation without limits in Oracle MySQL Server

LOW 31

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser).

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01024 Published 2025-01-21 Partial fix CWE-770

TI-2025-15478 CVE-2025-21518 · GHSA-mmr8-fpcp-hg5w

Resource allocation without limits in Oracle MySQL Cluster

LOW 31

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01066 Published 2025-01-21 Partial fix CWE-770

TI-2025-15461 CVE-2025-21501 · GHSA-2rv4-97h7-fxhx

Resource allocation without limits in Oracle MySQL Server

LOW 31

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01005 Published 2025-01-21 Partial fix CWE-770

TI-2025-15460 CVE-2025-21500 · GHSA-23cj-6mpm-r98j

Resource allocation without limits in Oracle MySQL Server

LOW 31

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01005 Published 2025-01-21 Partial fix CWE-770

TI-2024-14007 CVE-2024-21230 · GHSA-m6rg-98pc-7rxm

Uncontrolled resource consumption in Oracle MySQL Cluster

LOW 31

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0093 Published 2024-10-15 Fixed CWE-400

TI-2024-13983 CVE-2024-21196 · GHSA-m7rw-p49v-xvr4

Uncontrolled resource consumption in Oracle MySQL Server

LOW 30

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: X Plugin).

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00876 Published 2024-10-15 Fixed CWE-400

TI-2025-15519 CVE-2025-21559 · GHSA-fcqg-w4pm-f4j3

Missing authentication in Oracle MySQL Server

LOW 28

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).

CVSS 3.1MEDIUM 5.5 Network High privileges No interaction EPSS 0.00724 Published 2025-01-21 Fixed CWE-306

TI-2025-15515 CVE-2025-21555 · GHSA-gc8h-qjvm-5f2g

Incorrect authorization in Oracle MySQL Server

LOW 28

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).

CVSS 3.1MEDIUM 5.5 Network High privileges No interaction EPSS 0.00724 Published 2025-01-21 Fixed CWE-863

TI-2024-14015 CVE-2024-21238 · GHSA-cgw6-mmr2-9474

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Thread…

LOW 26

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Thread Pooling).

CVSS 3.1MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00877 Published 2024-10-15 Fixed

TI-2025-15500 CVE-2025-21540 · GHSA-gpx9-7g7w-37gv

Incorrect authorization in Oracle MySQL Server

LOW 25

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges).

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00489 Published 2025-01-21 Partial fix CWE-863

TI-2025-15489 CVE-2025-21529 · GHSA-ppw6-g989-268j

Uncontrolled resource consumption in Oracle MySQL Server

LOW 25

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema).

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.01052 Published 2025-01-21 Partial fix CWE-400

TI-2025-15465 CVE-2025-21505 · GHSA-mj35-5954-95cc

Resource allocation without limits in Oracle MySQL Server

LOW 25

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Components Services).

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.01057 Published 2025-01-21 Partial fix CWE-770

TI-2025-15464 CVE-2025-21504 · GHSA-m32h-hfwg-3r8r

Resource allocation without limits in Oracle MySQL Server

LOW 25

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.01265 Published 2025-01-21 Fixed CWE-770

TI-2025-15463 CVE-2025-21503 · GHSA-jmrx-rc46-hc9p

Resource allocation without limits in Oracle MySQL Server

LOW 25

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.01057 Published 2025-01-21 Partial fix CWE-770

TI-2025-15457 CVE-2025-21497 · GHSA-r27c-5qfm-c764

Origin validation error in Oracle MySQL Server

LOW 25

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).

CVSS 3.1MEDIUM 5.5 Network High privileges No interaction EPSS 0.00462 Published 2025-01-21 Partial fix CWE-346

TI-2025-15451 CVE-2025-21490 · GHSA-rh26-2566-h5m7

Resource allocation without limits in Oracle MySQL Server

LOW 25

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.01274 Published 2025-01-21 Partial fix CWE-770

TI-2024-14013 CVE-2024-21236 · GHSA-2rhg-4865-8qfj

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).

LOW 25

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.01075 Published 2024-10-15 Fixed

TI-2025-15503 CVE-2025-21543 · GHSA-vr47-q82p-p8ph

Resource allocation without limits in Oracle MySQL Cluster

LOW 24

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Packaging).

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00858 Published 2025-01-21 Partial fix CWE-770

TI-2025-15496 CVE-2025-21536 · GHSA-x8pw-mh46-hjmh

Resource allocation without limits in Oracle MySQL Server

LOW 24

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00957 Published 2025-01-21 Fixed CWE-770

TI-2025-15494 CVE-2025-21534 · GHSA-gg68-xh96-g8xv

Resource allocation without limits in Oracle MySQL Server

LOW 24

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Performance Schema).

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00957 Published 2025-01-21 Partial fix CWE-770

TI-2025-15491 CVE-2025-21531 · GHSA-jqx9-x6x8-85cw

Resource allocation without limits in Oracle MySQL Cluster

LOW 24

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.01015 Published 2025-01-21 Partial fix CWE-770

TI-2025-15485 CVE-2025-21525 · GHSA-cxgv-fj39-2f6g

Resource allocation without limits in Oracle MySQL Server

LOW 24

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL).

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.01015 Published 2025-01-21 Fixed CWE-770

TI-2025-15483 CVE-2025-21523 · GHSA-frcw-qgph-774m

Incorrect permission assignment in Oracle MySQL Server

LOW 24

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00939 Published 2025-01-21 Partial fix CWE-732

TI-2025-15452 CVE-2025-21491 · GHSA-733h-c5c6-mqj2

Resource allocation without limits in Oracle MySQL Server

LOW 24

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00998 Published 2025-01-21 Fixed CWE-770

TI-2024-14017 CVE-2024-21241 · GHSA-c494-hg27-rg85

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).

LOW 24

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00867 Published 2024-10-15 Fixed

TI-2024-14016 CVE-2024-21239 · GHSA-vggh-55p7-p625

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).

LOW 24

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.01014 Published 2024-10-15 Fixed

TI-2024-14006 CVE-2024-21219 · GHSA-c72q-9j4p-2mp4

Uncontrolled resource consumption in Oracle MySQL Server

LOW 24

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML).

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00942 Published 2024-10-15 Fixed CWE-400

TI-2024-14005 CVE-2024-21218 · GHSA-vqmm-339w-hc7c

Uncontrolled resource consumption in Oracle MySQL Cluster

LOW 24

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00942 Published 2024-10-15 Fixed CWE-400

TI-2024-13990 CVE-2024-21203 · GHSA-cj7p-fg4w-qrvh

Uncontrolled resource consumption in Oracle MySQL Cluster

LOW 24

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: FTS).

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00888 Published 2024-10-15 Fixed CWE-400

TI-2024-13988 CVE-2024-21201 · GHSA-xhf9-m56c-xh6w

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).

LOW 24

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00888 Published 2024-10-15 Fixed

TI-2024-13986 CVE-2024-21199 · GHSA-w76f-wfx3-5qjq

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).

LOW 24

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00888 Published 2024-10-15 Fixed

TI-2024-13985 CVE-2024-21198 · GHSA-j5r3-hxmp-cxpr

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL).

LOW 24

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL).

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.0085 Published 2024-10-15 Fixed

TI-2024-13984 CVE-2024-21197 · GHSA-fv75-hjwp-hmcm

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information…

LOW 24

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema).

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.0085 Published 2024-10-15 Fixed

TI-2024-13981 CVE-2024-21194 · GHSA-m2x9-pvwq-m49p

Uncontrolled resource consumption in Oracle MySQL Server

LOW 24

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.0085 Published 2024-10-15 Fixed CWE-400

TI-2024-13980 CVE-2024-21193 · GHSA-r97q-xhcv-9xx9

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: PS).

LOW 24

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: PS).

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00902 Published 2024-10-15 Fixed

TI-2025-15479 CVE-2025-21519 · GHSA-945p-45hq-35x9

Incorrect authorization in Oracle MySQL Server

LOW 22

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges).

CVSS 3.1MEDIUM 4.4 Network High privileges No interaction EPSS 0.00853 Published 2025-01-21 Partial fix CWE-863

TI-2024-13999 CVE-2024-21212 · GHSA-h3ph-4h6g-xqfq

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Health…

LOW 22

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Health Monitor).

CVSS 3.1MEDIUM 4.4 Network High privileges No interaction EPSS 0.00936 Published 2024-10-15 Fixed

TI-2025-15506 CVE-2025-21546 · GHSA-gw84-4qc8-q6cv

Incorrect authorization in Oracle MySQL Server

LOW 19

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges).

CVSS 3.1LOW 3.8 Network High privileges No interaction EPSS 0.00564 Published 2025-01-21 Partial fix CWE-863

TI-2025-15455 CVE-2025-21494 · GHSA-7vhr-3h3v-9gqg

Resource allocation without limits in Oracle MySQL Server

LOW 19

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges).

CVSS 3.1MEDIUM 4.1 Local High privileges No interaction EPSS 0.00287 Published 2025-01-21 Fixed CWE-770

TI-2024-14023 CVE-2024-21247 · GHSA-vchj-ggm5-9rcm

Improper access control in Oracle MySQL Cluster

LOW 19

Vulnerability in the MySQL Client product of Oracle MySQL (component: Client: mysqldump).

CVSS 3.1LOW 3.8 Network High privileges No interaction EPSS 0.00611 Published 2024-10-15 Partial fix CWE-284

TI-2024-14000 CVE-2024-21213 · GHSA-mffh-p59m-fv66

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).

LOW 19

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).

CVSS 3.1MEDIUM 4.2 Local High privileges User interaction EPSS 0.00313 Published 2024-10-15 Fixed

TI-2024-14008 CVE-2024-21231 · GHSA-jv2x-g26c-46cq

Uncontrolled resource consumption in Oracle MySQL Server

LOW 17

Vulnerability in the MySQL Server product of Oracle MySQL (component: Client programs).

CVSS 3.1LOW 3.1 Network Low privileges No interaction EPSS 0.00873 Published 2024-10-15 Partial fix CWE-400

TI-2024-14014 CVE-2024-21237 · GHSA-xcwx-vhj6-p7m7

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Group…

LOW 13

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Group Replication GCS).

CVSS 3.1LOW 2.2 Network High privileges No interaction EPSS 0.00704 Published 2024-10-15 Partial fix

TI-2025-15480 CVE-2025-21520 · GHSA-394g-2wxx-rv2j

Incorrect permission assignment in Oracle MySQL Cluster

LOW 10

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Options).

CVSS 3.1LOW 1.8 Local High privileges User interaction EPSS 0.00301 Published 2025-01-21 Partial fix CWE-732