Summary
MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL.
The following packages have been upgraded to a later upstream version: mariadb (10.3). (BZ#2223572, BZ#2223574, BZ#2223962, BZ#2223965)
Security Fix(es):
* mariadb: segmentation fault via the component sub_select (CVE-2022-32084)
* mariadb: server crash in JOIN_CACHE::free or in copy_fields (CVE-2022-32091)
* mariadb: compress_write() fails to release mutex on failure (CVE-2022-38791)
* mariadb: NULL pointer dereference in spider_db_mbase::print_warnings() (CVE-2022-47015)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Bug Fix(es):
* [MariaDB 10.3.32] socat: E Failed to set SNI host "" (SST failure) (BZ#2223961)
Fixed packages 16
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 8 | galera | 25.3.37-1.module_el8.8.0+3609+204d4ab0 |
| AlmaLinux · 8 | Judy | 1.0.5-18.module_el8.6.0+2867+72759d2f |
| AlmaLinux · 8 | Judy | 1.0.5-18.module_el8.6.0+3138+72759d2f |
| AlmaLinux · 8 | mariadb | 3:10.3.39-1.module_el8.8.0+3609+204d4ab0 |
| AlmaLinux · 8 | mariadb-backup | 3:10.3.39-1.module_el8.8.0+3609+204d4ab0 |
| AlmaLinux · 8 | mariadb-common | 3:10.3.39-1.module_el8.8.0+3609+204d4ab0 |
| AlmaLinux · 8 | mariadb-devel | 3:10.3.39-1.module_el8.8.0+3609+204d4ab0 |
| AlmaLinux · 8 | mariadb-embedded | 3:10.3.39-1.module_el8.8.0+3609+204d4ab0 |
| AlmaLinux · 8 | mariadb-embedded-devel | 3:10.3.39-1.module_el8.8.0+3609+204d4ab0 |
| AlmaLinux · 8 | mariadb-errmsg | 3:10.3.39-1.module_el8.8.0+3609+204d4ab0 |
| AlmaLinux · 8 | mariadb-gssapi-server | 3:10.3.39-1.module_el8.8.0+3609+204d4ab0 |
| AlmaLinux · 8 | mariadb-oqgraph-engine | 3:10.3.39-1.module_el8.8.0+3609+204d4ab0 |
| AlmaLinux · 8 | mariadb-server | 3:10.3.39-1.module_el8.8.0+3609+204d4ab0 |
| AlmaLinux · 8 | mariadb-server-galera | 3:10.3.39-1.module_el8.8.0+3609+204d4ab0 |
| AlmaLinux · 8 | mariadb-server-utils | 3:10.3.39-1.module_el8.8.0+3609+204d4ab0 |
| AlmaLinux · 8 | mariadb-test | 3:10.3.39-1.module_el8.8.0+3609+204d4ab0 |
Vulnerabilities 5
-
High 7.5
Mariadb: node crashes with transport endpoint is not connected mysqld got signal 6
A vulnerability was found in MariaDB. An OpenVAS port scan on ports 3306 and 4567 allows a malicious remote client to cause a denial of service.
-
Medium 6.5
MariaDB Server before 10.3.34 thru 10.9.3 is vulnerable to Denial of Service. It is possible for function spider_db_mba…
-
Unscored —
MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component sub_select.
-
Unscored —
MariaDB v10.7 was discovered to contain an use-after-poison in in __interceptor_memset at /libsanitizer/sanitizer_commo…
-
Unscored —
In MariaDB before 10.9.2, compress_write in extra/mariabackup/ds_compress.cc does not release data_mutex upon a stream …
References
-
report
https://access.redhat.com/security/cve/CVE-2022-32084
-
report
https://access.redhat.com/security/cve/CVE-2022-32091
-
report
https://access.redhat.com/security/cve/CVE-2022-38791
-
report
https://access.redhat.com/security/cve/CVE-2022-47015
-
report
https://bugzilla.redhat.com/2106034
-
report
https://bugzilla.redhat.com/2106042
-
report
https://bugzilla.redhat.com/2130105
-
report
https://bugzilla.redhat.com/2163609
-
report
https://bugzilla.redhat.com/2223572
-
report
https://bugzilla.redhat.com/2223574
-
report
https://bugzilla.redhat.com/2223961
-
report
https://bugzilla.redhat.com/2223962
-
advisory
https://errata.almalinux.org/8/ALSA-2023-5259.html
-
report
https://www.redhat.com/security/data/cve/CVE-2023-5157.html