Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-3494: In MariaDB server version through 11.8.5, when server audit plugin is enabled with server_audit_events variable configured with QUERY_DCL, QUERY_DDL, or QUERY_DML filtering, if an authenticated database user invokes a SQL statement prefixed with double-hyphen (--) or hash (#) style comments, the statement is not logged. CVE-2026-34303: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
Fixed packages 29
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | mariadb114 | 3:11.4.10-1.amzn2023.0.1 |
| Amazon Linux · 2023 | mariadb114-backup | 3:11.4.10-1.amzn2023.0.1 |
| Amazon Linux · 2023 | mariadb114-backup-debuginfo | 3:11.4.10-1.amzn2023.0.1 |
| Amazon Linux · 2023 | mariadb114-client-utils | 3:11.4.10-1.amzn2023.0.1 |
| Amazon Linux · 2023 | mariadb114-common | 3:11.4.10-1.amzn2023.0.1 |
| Amazon Linux · 2023 | mariadb114-connect-engine | 3:11.4.10-1.amzn2023.0.1 |
| Amazon Linux · 2023 | mariadb114-connect-engine-debuginfo | 3:11.4.10-1.amzn2023.0.1 |
| Amazon Linux · 2023 | mariadb114-cracklib-password-check | 3:11.4.10-1.amzn2023.0.1 |
| Amazon Linux · 2023 | mariadb114-cracklib-password-check-debuginfo | 3:11.4.10-1.amzn2023.0.1 |
| Amazon Linux · 2023 | mariadb114-debuginfo | 3:11.4.10-1.amzn2023.0.1 |
| Amazon Linux · 2023 | mariadb114-debugsource | 3:11.4.10-1.amzn2023.0.1 |
| Amazon Linux · 2023 | mariadb114-devel | 3:11.4.10-1.amzn2023.0.1 |
| Amazon Linux · 2023 | mariadb114-errmsg | 3:11.4.10-1.amzn2023.0.1 |
| Amazon Linux · 2023 | mariadb114-gssapi-server | 3:11.4.10-1.amzn2023.0.1 |
| Amazon Linux · 2023 | mariadb114-gssapi-server-debuginfo | 3:11.4.10-1.amzn2023.0.1 |
| Amazon Linux · 2023 | mariadb114-oqgraph-engine | 3:11.4.10-1.amzn2023.0.1 |
| Amazon Linux · 2023 | mariadb114-oqgraph-engine-debuginfo | 3:11.4.10-1.amzn2023.0.1 |
| Amazon Linux · 2023 | mariadb114-pam | 3:11.4.10-1.amzn2023.0.1 |
| Amazon Linux · 2023 | mariadb114-pam-debuginfo | 3:11.4.10-1.amzn2023.0.1 |
| Amazon Linux · 2023 | mariadb114-rocksdb-engine | 3:11.4.10-1.amzn2023.0.1 |
| Amazon Linux · 2023 | mariadb114-rocksdb-engine-debuginfo | 3:11.4.10-1.amzn2023.0.1 |
| Amazon Linux · 2023 | mariadb114-server | 3:11.4.10-1.amzn2023.0.1 |
| Amazon Linux · 2023 | mariadb114-server-debuginfo | 3:11.4.10-1.amzn2023.0.1 |
| Amazon Linux · 2023 | mariadb114-server-utils | 3:11.4.10-1.amzn2023.0.1 |
| Amazon Linux · 2023 | mariadb114-server-utils-debuginfo | 3:11.4.10-1.amzn2023.0.1 |
| Amazon Linux · 2023 | mariadb114-sphinx-engine | 3:11.4.10-1.amzn2023.0.1 |
| Amazon Linux · 2023 | mariadb114-sphinx-engine-debuginfo | 3:11.4.10-1.amzn2023.0.1 |
| Amazon Linux · 2023 | mariadb114-test | 3:11.4.10-1.amzn2023.0.1 |
| Amazon Linux · 2023 | mariadb114-test-debuginfo | 3:11.4.10-1.amzn2023.0.1 |
Vulnerabilities 2
-
Medium 6.5
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…
-
Medium 4.3CVE-2026-3494 Public exploit
MariaDB Server Audit Plugin Comment Handling Bypass
In MariaDB server version through 11.8.5, when server audit plugin is enabled with server_audit_events variable configured with QUERY_DCL, QUERY_DDL, or QUERY_DML filtering, if an authenticated database user invokes a SQL statement prefixed with double-hyphen…