Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML).
Priority LOW 27Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 7 fixed, 3 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.
Summary
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 5.7.33 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02603 85th percentileScored 2026-11-07
Fix Partial Red Hat: 6 advisoriesRed Hat: 7 fixed, 3 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Oracle | MySQL Server | up to 5.7.33 | — | No fix listed | CNA |
- MySQL Server VendorOracle Affected up to 5.7.33 Fixed in — No fix listed CNA
CPE configurations NVD · 10
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:* | 5.7.0 – 5.7.33 | Vulnerable | Oracle |
| cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:* | 10.2.0 to before 10.2.38; 10.3.0 to before 10.3.29; 10.4.0 to before 10.4.19; 10.5.0 to before 10.5.10 | Vulnerable | MariaDB |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* | 32 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* | 33 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* | 34 | Vulnerable | Fedoraproject |
- cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:* Versions 5.7.0 – 5.7.33 Vulnerable ·Oracle
- cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:* Versions 10.2.0 to before 10.2.38; 10.3.0 to before 10.3.29; 10.4.0 to before 10.4.19; 10.5.0 to before 10.5.10 Vulnerable ·MariaDB
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* Versions 32 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* Versions 33 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* Versions 34 Vulnerable ·Fedoraproject
Remediation
Red Hat 6 advisories
- RHSA-2023:6821 Released 2023-11-08 · Red Hat rating Importantmariadb:10.5 security update
- Red Hat Enterprise Linux AppStream AUS (v.8.4) Judy-1.0.5-18.module+el8.4.0+9031+9abc7af9.src::mariadb:10.5, Judy-1.0.5-18.module+el8.4.0+9031+9abc7af9.x86_64::mariadb:10.5, galera-26.4.14-1.module+el8.4.0+20291+fd32d29c.src::mariadb:10.5 +16
- Red Hat Enterprise Linux AppStream E4S (v.8.4) Judy-1.0.5-18.module+el8.4.0+9031+9abc7af9.aarch64::mariadb:10.5, Judy-1.0.5-18.module+el8.4.0+9031+9abc7af9.ppc64le::mariadb:10.5, Judy-1.0.5-18.module+el8.4.0+9031+9abc7af9.s390x::mariadb:10.5 +47
- Red Hat Enterprise Linux AppStream TUS (v.8.4) Judy-1.0.5-18.module+el8.4.0+9031+9abc7af9.src::mariadb:10.5, Judy-1.0.5-18.module+el8.4.0+9031+9abc7af9.x86_64::mariadb:10.5, galera-26.4.14-1.module+el8.4.0+20291+fd32d29c.src::mariadb:10.5 +16
- RHSA-2022:4818 Released 2022-05-31 · Red Hat rating Moderatemariadb:10.3 security and bug fix update
- Red Hat Enterprise Linux AppStream EUS (v.8.4) Judy-1.0.5-18.module+el8+2765+cfa4f87b.aarch64::mariadb:10.3, Judy-1.0.5-18.module+el8+2765+cfa4f87b.ppc64le::mariadb:10.3, Judy-1.0.5-18.module+el8+2765+cfa4f87b.s390x::mariadb:10.3 +47
- RHSA-2022:1556 Released 2022-04-26 · Red Hat rating Moderatemariadb:10.3 security and bug fix update
- Red Hat Enterprise Linux AppStream (v. 8) Judy-1.0.5-18.module+el8+2765+cfa4f87b.aarch64::mariadb:10.3, Judy-1.0.5-18.module+el8+2765+cfa4f87b.ppc64le::mariadb:10.3, Judy-1.0.5-18.module+el8+2765+cfa4f87b.s390x::mariadb:10.3 +47
Show 3 more Red Hat advisories
- RHSA-2022:1557 Released 2022-04-26 · Red Hat rating Moderatemariadb:10.5 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 8) Judy-1.0.5-18.module+el8.4.0+9031+9abc7af9.aarch64::mariadb:10.5, Judy-1.0.5-18.module+el8.4.0+9031+9abc7af9.ppc64le::mariadb:10.5, Judy-1.0.5-18.module+el8.4.0+9031+9abc7af9.s390x::mariadb:10.5 +47
- RHSA-2022:1010 Released 2022-03-22 · Red Hat rating Moderaterh-mariadb103-mariadb security and bug fix update
- Red Hat Software Collections for RHEL Workstation(v. 7) rh-mariadb103-galera-25.3.34-4.el7, rh-mariadb103-mariadb-3:10.3.32-2.el7, rh-mariadb103-mariadb-backup-3:10.3.32-2.el7 +17
- Red Hat Software Collections for RHEL(v. 7) rh-mariadb103-galera-25.3.34-4.el7, rh-mariadb103-mariadb-3:10.3.32-2.el7, rh-mariadb103-mariadb-backup-3:10.3.32-2.el7 +17
- RHSA-2022:1007 Released 2022-03-22 · Red Hat rating Moderaterh-mariadb105-mariadb security and bug fix update
- Red Hat Software Collections for RHEL Workstation(v. 7) rh-mariadb105-galera-26.4.9-3.el7, rh-mariadb105-mariadb-3:10.5.13-1.el7, rh-mariadb105-mariadb-backup-3:10.5.13-1.el7 +19
- Red Hat Software Collections for RHEL(v. 7) rh-mariadb105-galera-26.4.9-3.el7, rh-mariadb105-mariadb-3:10.5.13-1.el7, rh-mariadb105-mariadb-backup-3:10.5.13-1.el7 +19
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
Oracle MySQL Server — FEDORA-2021-68db93b130
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2021-01844 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML).Priority LOW 30
- Advisory ·
Oracle MySQL Server — FEDORA-2021-27187ac9dd
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2021-01844 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML).Priority LOW 30
Show 1 more group
- Advisory ·
Oracle MySQL Server — FEDORA-2021-179f2fbb88
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2021-01844 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML).Priority LOW 30
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat OpenStack Platform 10 (Newton) | Affected | No fix planned: Out of support scope |
| Red Hat OpenStack Platform 13 (Queens) | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2022:1556, RHSA-2022:1557 |
| Red Hat Enterprise Linux AppStream AUS (v.8.4) | Fixed | RHSA-2023:6821 |
| Red Hat Enterprise Linux AppStream E4S (v.8.4) | Fixed | RHSA-2023:6821 |
| Red Hat Enterprise Linux AppStream EUS (v.8.4) | Fixed | RHSA-2022:4818 |
| Red Hat Enterprise Linux AppStream TUS (v.8.4) | Fixed | RHSA-2023:6821 |
| Red Hat Software Collections for RHEL Workstation(v. 7) | Fixed | RHSA-2022:1007, RHSA-2022:1010 |
| Red Hat Software Collections for RHEL(v. 7) | Fixed | RHSA-2022:1007, RHSA-2022:1010 |
Not affected: 4 products
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Software Collections
Timeline
- 2026-10-02 Threatist record created from CVE-2021-2154
- 2026-10-03 Alias added: GHSA-c827-7w49-pg8j
References
More Oracle Mysql vulnerabilities
- TI-2017-02794 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server… CVSS 3.0HIGH 7.5
- TI-2016-05707 Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB… CVSS 3.0CRITICAL 9.8
- TI-2003-00723 Buffer overflow in get_salt_from_password from sql_acl.cc for MySQL 4.0.14 and earlier… CVSS 2.0HIGH 9.0
- TI-2020-04444 RFD Attack via "Content-Disposition" Header Sourced from Request Input by Spring MVC or Spring WebFlux Application CVSS 3.1HIGH 7.5
- TI-2008-00208 Multiple buffer overflows in yaSSL 1.7.5 and earlier, as used in MySQL and possibly other… CVSS 2.0HIGH 7.5
- TI-2020-01888 Segmentation fault in SSL_check_chain CVSS 3.1HIGH 7.5
Sources
- CVE-2021-2154 · CVE Program
- CVE-2021-2154 · NVD
- FIRST EPSS
- GHSA-c827-7w49-pg8j · GitHub Advisory Database · CC BY 4.0
- CVE-2021-2154 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences