Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Partition).
Priority LOW 25Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.
Summary
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Partition). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01388 72nd percentileScored 2026-11-07
Fix Fixed Red Hat: 3 advisories
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Oracle | MySQL Server | up to 8.0.32 | — | No fix listed | CNA |
- MySQL Server VendorOracle Affected up to 8.0.32 Fixed in — No fix listed CNA
CPE configurations NVD · 9
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:* | 8.0.0 – 8.0.32 | Vulnerable | Oracle |
| cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* | 37 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* | 38 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:* | 39 | Vulnerable | Fedoraproject |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
- cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:* Versions 8.0.0 – 8.0.32 Vulnerable ·Oracle
- cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* Versions 37 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* Versions 38 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:* Versions 39 Vulnerable ·Fedoraproject
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
Remediation
Red Hat 3 advisories
- RHSA-2024:2619 Released 2024-04-30 · Red Hat rating Moderaterh-mysql80-mysql security update
- Red Hat Software Collections for RHEL Workstation(v. 7) rh-mysql80-mysql-8.0.36-1.el7, rh-mysql80-mysql-common-8.0.36-1.el7, rh-mysql80-mysql-config-8.0.36-1.el7 +8
- Red Hat Software Collections for RHEL(v. 7) rh-mysql80-mysql-8.0.36-1.el7, rh-mysql80-mysql-common-8.0.36-1.el7, rh-mysql80-mysql-config-8.0.36-1.el7 +8
- RHSA-2024:1141 Released 2024-03-05 · Red Hat rating Moderatemysql security update
- Red Hat CodeReady Linux Builder (v. 9) mysql-devel-8.0.36-1.el9_3, mysql-libs-8.0.36-1.el9_3, mysql-test-8.0.36-1.el9_3
- Red Hat Enterprise Linux AppStream (v. 9) mysql-8.0.36-1.el9_3, mysql-common-8.0.36-1.el9_3, mysql-errmsg-8.0.36-1.el9_3 +1
- RHSA-2024:0894 Released 2024-02-20 · Red Hat rating Moderatemysql:8.0 security update
- Red Hat Enterprise Linux AppStream (v. 8) mecab-0.996-2.module+el8.9.0+21207+6c20cb3d.aarch64::mysql:8.0, mecab-0.996-2.module+el8.9.0+21207+6c20cb3d.ppc64le::mysql:8.0, mecab-0.996-2.module+el8.9.0+21207+6c20cb3d.s390x::mysql:8.0 +44
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
Oracle MySQL Server — oracle.com/security-alerts/cpuapr2023.html
23 records Highest priority Priority LOW 23 LOW
Other records, highest priority first
- TI-2023-08352 Improper access control in Oracle MySQL ServerPriority LOW 35
- TI-2023-08288 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security…Priority LOW 35
- TI-2023-08321 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).Priority LOW 32
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat CodeReady Linux Builder (v. 9) | Fixed | RHSA-2024:1141 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2024:0894 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2024:1141 |
| Red Hat Software Collections for RHEL Workstation(v. 7) | Fixed | RHSA-2024:2619 |
| Red Hat Software Collections for RHEL(v. 7) | Fixed | RHSA-2024:2619 |
Not affected: 6 products
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat OpenStack Platform 13 (Queens)
- Red Hat Software Collections
Timeline
- 2026-10-02 Threatist record created from CVE-2023-21955
- 2026-10-03 Alias added: GHSA-9vf7-w4v4-w7jp
References
Patch 1
Other 3
- https://lists.fedoraproject.org/archives/list/[email protected]/message/C63HAGVLQA6FJNDCHR7CNZZL6VSLILB2/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/JEHRBBYYTPA4DETOM5XAKGCP37NUTLOA/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/QYLDK6ODVC4LJSDULLX6Q2YHTFOWABCN/
More Oracle Mysql Server vulnerabilities
- TI-2021-02645 SM2 Decryption Buffer Overflow CVSS 3.1CRITICAL 9.8
- TI-2022-01176 The c_rehash script allows command injection CVSS 3.1CRITICAL 9.8
- TI-2021-04451 XStream is vulnerable to an Arbitrary Code Execution attack CVSS 3.1CRITICAL 9.1
- TI-2021-04444 XStream is vulnerable to an Arbitrary Code Execution attack CVSS 3.1CRITICAL 9.8
- TI-2021-05762 Use after free in https://github.com/curl/curl CVSS 3.1HIGH 8.1
- TI-2021-05807 Cleartext transmission of sensitive information in https://github.com/curl/curl CVSS 3.1HIGH 7.5
Sources
- CVE-2023-21955 · CVE Program
- CVE-2023-21955 · NVD
- FIRST EPSS
- GHSA-9vf7-w4v4-w7jp · GitHub Advisory Database · CC BY 4.0
- CVE-2023-21955 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences