Skip to content
OpenAdvisories
Medium ALAS2-2023-2057 10 CVEs

Moderate: mariadb security update (Amazon Linux 2)

Published May 25, 2023 · Updated Jun 1, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-31624: MariaDB Server before 10.7 is vulnerable to Denial of Service. While executing the plugin/server_audit/server_audit.c method log_statement_ex, the held lock lock_bigbuffer is not released correctly, which allows local users to trigger a denial of service due to the deadlock. CVE-2022-27384: An issue in the component Item_subselect::init_expr_cache_tracker of MariaDB Server v10.6 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL statements. CVE-2022-27380: An issue in the component my_decimal::operator= of MariaDB Server v10.6.3 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL statements. CVE-2021-46668: MariaDB through 10.5.9 allows an application crash via certain long SELECT DISTINCT statements that improperly interact with storage-engine resource limitations for temporary data structures. CVE-2021-46667: An integer overflow vulnerability was found in MariaDB, where an invalid size of ref_pointer_array is allocated. This issue results in a denial of service. CVE-2021-46666: MariaDB before 10.6.2 allows an application crash because of mishandling of a pushdown from a HAVING clause to a WHERE clause. CVE-2021-46663: MariaDB through 10.5.13 allows a ha_maria::extra application crash via certain SELECT statements. CVE-2021-46661: MariaDB through 10.5.9 allows an application crash in find_field_in_tables and find_order_in_list via an unused common table expression (CTE). CVE-2021-46659: MariaDB before 10.7.2 allows an application crash because it does not recognize that SELECT_LEX::nest_level is local to each VIEW. CVE-2021-46657: get_sort_by_table in MariaDB before 10.6.2 allows an application crash via certain subquery uses of ORDER BY.

Fixed packages 9

ReleasePackageFixed in
Amazon Linux · 2 mariadb 1:5.5.68-1.amzn2.0.1
Amazon Linux · 2 mariadb-bench 1:5.5.68-1.amzn2.0.1
Amazon Linux · 2 mariadb-debuginfo 1:5.5.68-1.amzn2.0.1
Amazon Linux · 2 mariadb-devel 1:5.5.68-1.amzn2.0.1
Amazon Linux · 2 mariadb-embedded 1:5.5.68-1.amzn2.0.1
Amazon Linux · 2 mariadb-embedded-devel 1:5.5.68-1.amzn2.0.1
Amazon Linux · 2 mariadb-libs 1:5.5.68-1.amzn2.0.1
Amazon Linux · 2 mariadb-server 1:5.5.68-1.amzn2.0.1
Amazon Linux · 2 mariadb-test 1:5.5.68-1.amzn2.0.1

Vulnerabilities 10

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-46657.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-46659.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-46661.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-46663.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-46666.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-46667.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-46668.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-27380.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-27384.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-31624.html