Summary
MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon (mysqld) and many client programs and libraries.
Security Fix(es):
* openssl: SSL_select_next_proto buffer overread (CVE-2024-5535)
* krb5: GSS message token handling (CVE-2024-37371)
* curl: libcurl: ASN.1 date parser overread (CVE-2024-7264)
* mysql: Thread Pooling unspecified vulnerability (CPU Oct 2024) (CVE-2024-21238)
* mysql: X Plugin unspecified vulnerability (CPU Oct 2024) (CVE-2024-21196)
* mysql: Optimizer unspecified vulnerability (CPU Oct 2024) (CVE-2024-21241)
* mysql: Client programs unspecified vulnerability (CPU Oct 2024) (CVE-2024-21231)
* mysql: Information Schema unspecified vulnerability (CPU Oct 2024) (CVE-2024-21197)
* mysql: InnoDB unspecified vulnerability (CPU Oct 2024) (CVE-2024-21218)
* mysql: Optimizer unspecified vulnerability (CPU Oct 2024) (CVE-2024-21201)
* mysql: InnoDB unspecified vulnerability (CPU Oct 2024) (CVE-2024-21236)
* mysql: Group Replication GCS unspecified vulnerability (CPU Oct 2024) (CVE-2024-21237)
* mysql: FTS unspecified vulnerability (CPU Oct 2024) (CVE-2024-21203)
* mysql: Health Monitor unspecified vulnerability (CPU Oct 2024) (CVE-2024-21212)
* mysql: DML unspecified vulnerability (CPU Oct 2024) (CVE-2024-21219)
* mysql: Optimizer unspecified vulnerability (CPU Oct 2024) (CVE-2024-21230)
* mysql: InnoDB unspecified vulnerability (CPU Oct 2024) (CVE-2024-21213)
* mysql: InnoDB unspecified vulnerability (CPU Oct 2024) (CVE-2024-21194)
* mysql: InnoDB unspecified vulnerability (CPU Oct 2024) (CVE-2024-21199)
* mysql: PS unspecified vulnerability (CPU Oct 2024) (CVE-2024-21193)
* mysql: DDL unspecified vulnerability (CPU Oct 2024) (CVE-2024-21198)
* mysql: mysqldump unspecified vulnerability (CPU Oct 2024) (CVE-2024-21247)
* mysql: InnoDB unspecified vulnerability (CPU Oct 2024) (CVE-2024-21239)
* curl: curl netrc password leak (CVE-2024-11053)
* mysql: InnoDB unspecified vulnerability (CPU Jan 2025) (CVE-2025-21497)
* mysql: MySQL Server Options Vulnerability (CVE-2025-21520)
* mysql: High Privilege Denial of Service Vulnerability in MySQL Server (CVE-2025-21490)
* mysql: Information Schema unspecified vulnerability (CPU Jan 2025) (CVE-2025-21529)
* mysql: InnoDB unspecified vulnerability (CPU Jan 2025) (CVE-2025-21531)
* mysql: Optimizer unspecified vulnerability (CPU Jan 2025) (CVE-2025-21504)
* mysql: Privileges unspecified vulnerability (CPU Jan 2025) (CVE-2025-21540)
* mysql: MySQL Server InnoDB Denial of Service and Unauthorized Data Modification Vulnerability (CVE-2025-21555)
* mysql: Packaging unspecified vulnerability (CPU Jan 2025) (CVE-2025-21543)
* mysql: MySQL Server InnoDB Denial of Service and Unauthorized Data Modification Vulnerability (CVE-2025-21491)
* mysql: DDL unspecified vulnerability (CPU Jan 2025) (CVE-2025-21525)
* mysql: Optimizer unspecified vulnerability (CPU Jan 2025) (CVE-2025-21536)
* mysql: Thread Pooling unspecified vulnerability (CPU Jan 2025) (CVE-2025-21521)
* mysql: Optimizer unspecified vulnerability (CPU Jan 2025) (CVE-2025-21501)
* mysql: Performance Schema unspecified vulnerability (CPU Jan 2025) (CVE-2025-21534)
* mysql: Privileges unspecified vulnerability (CPU Jan 2025) (CVE-2025-21494)
* mysql: Privileges unspecified vulnerability (CPU Jan 2025) (CVE-2025-21519)
* mysql: Parser unspecified vulnerability (CPU Jan 2025) (CVE-2025-21522)
* mysql: InnoDB unspecified vulnerability (CPU Jan 2025) (CVE-2025-21503)
* mysql: Optimizer unspecified vulnerability (CPU Jan 2025) (CVE-2025-21518)
* mysql: MySQL Server InnoDB Denial of Service and Unauthorized Data Modification Vulnerability (CVE-2025-21559)
* mysql: Privilege Misuse in MySQL Server Security Component (CVE-2025-21546)
* mysql: Optimizer unspecified vulnerability (CPU Jan 2025) (CVE-2025-21500)
* mysql: InnoDB unspecified vulnerability (CPU Jan 2025) (CVE-2025-21523)
* mysql: Components Services unspecified vulnerability (CPU Jan 2025) (CVE-2025-21505)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 9 | mysql | 8.0.41-2.el9_5 |
| AlmaLinux · 9 | mysql-common | 8.0.41-2.el9_5 |
| AlmaLinux · 9 | mysql-devel | 8.0.41-2.el9_5 |
| AlmaLinux · 9 | mysql-errmsg | 8.0.41-2.el9_5 |
| AlmaLinux · 9 | mysql-libs | 8.0.41-2.el9_5 |
| AlmaLinux · 9 | mysql-server | 8.0.41-2.el9_5 |
| AlmaLinux · 9 | mysql-test | 8.0.41-2.el9_5 |
Vulnerabilities 49
-
Critical 9.1
In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can cause invalid memory reads during GSS message token handlin…
-
Critical 9.1CVE-2024-5535 Public exploit
SSL_select_next_proto buffer overread
Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an empty supported client protocols buffer may cause a crash or memory contents to be sent to the peer. Impact summary: A buffer overread can have a range of potential consequences suc…
-
High 7.5
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Thread Pooling). Supported versions that …
-
Medium 6.5
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: X Plugin). Supported versions that are af…
-
Medium 6.5
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…
-
Medium 6.5
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…
-
Medium 6.5
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…
-
Medium 6.5
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…
-
Medium 6.5
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser). Supported versions that are affe…
-
Medium 6.3CVE-2024-7264 EPSS 20%
ASN.1 date parser overread
libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an ASN.1 Generalized Time field. If given an syntactically incorrect field, the parser might end up using -1 for the length of the *time fraction*, leading to a `strlen()` getting per…
-
Medium 5.5
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…
-
Medium 5.5
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…
-
Medium 5.5
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…
-
Medium 5.4
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions…
-
Medium 5.3
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Thread Pooling). Supported versions that …
-
Medium 4.9
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: PS). Supported versions that are affected…
-
Medium 4.9
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…
-
Medium 4.9
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema). Supported versions t…
-
Medium 4.9
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affecte…
-
Medium 4.9
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…
-
Medium 4.9
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…
-
Medium 4.9
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: FTS). Supported versions that are affecte…
-
Medium 4.9
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…
-
Medium 4.9
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affecte…
-
Medium 4.9
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…
-
Medium 4.9
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…
-
Medium 4.9
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…
-
Medium 4.9
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…
-
Medium 4.9
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…
-
Medium 4.9
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…
-
Medium 4.9
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…
-
Medium 4.9
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Components Services). Supported versions …
-
Medium 4.9
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…
-
Medium 4.9
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affecte…
-
Medium 4.9
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema). Supported versions t…
-
Medium 4.9
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…
-
Medium 4.9
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Performance Schema). Supported versions t…
-
Medium 4.9
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…
-
Medium 4.9
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Packaging). Supported versions that are a…
-
Medium 4.4
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Health Monitor). Supported versions that …
-
Medium 4.4
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions…
-
Medium 4.2
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…
-
Medium 4.1
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions…
-
Low 3.8
Vulnerability in the MySQL Client product of Oracle MySQL (component: Client: mysqldump). Supported versions that are a…
-
Low 3.8
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions…
-
Low 3.4
netrc and redirect credential leak
When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has an entry that …
-
Low 3.1
Vulnerability in the MySQL Server product of Oracle MySQL (component: Client programs). Supported versions that are aff…
-
Low 2.2
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Group Replication GCS). Supported version…
-
Low 1.8
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Options). Supported versions that are aff…
References
-
report
https://access.redhat.com/security/cve/CVE-2024-11053
-
report
https://access.redhat.com/security/cve/CVE-2024-21193
-
report
https://access.redhat.com/security/cve/CVE-2024-21194
-
report
https://access.redhat.com/security/cve/CVE-2024-21196
-
report
https://access.redhat.com/security/cve/CVE-2024-21197
-
report
https://access.redhat.com/security/cve/CVE-2024-21198
-
report
https://access.redhat.com/security/cve/CVE-2024-21199
-
report
https://access.redhat.com/security/cve/CVE-2024-21201
-
report
https://access.redhat.com/security/cve/CVE-2024-21203
-
report
https://access.redhat.com/security/cve/CVE-2024-21212
-
report
https://access.redhat.com/security/cve/CVE-2024-21213
-
report
https://access.redhat.com/security/cve/CVE-2024-21218
-
report
https://access.redhat.com/security/cve/CVE-2024-21219
-
report
https://access.redhat.com/security/cve/CVE-2024-21230
-
report
https://access.redhat.com/security/cve/CVE-2024-21231
-
report
https://access.redhat.com/security/cve/CVE-2024-21236
-
report
https://access.redhat.com/security/cve/CVE-2024-21237
-
report
https://access.redhat.com/security/cve/CVE-2024-21238
-
report
https://access.redhat.com/security/cve/CVE-2024-21239
-
report
https://access.redhat.com/security/cve/CVE-2024-21241
-
report
https://access.redhat.com/security/cve/CVE-2024-21247
-
report
https://access.redhat.com/security/cve/CVE-2024-37371
-
report
https://access.redhat.com/security/cve/CVE-2024-5535
-
report
https://access.redhat.com/security/cve/CVE-2024-7264
-
report
https://access.redhat.com/security/cve/CVE-2025-21490
-
report
https://access.redhat.com/security/cve/CVE-2025-21491
-
report
https://access.redhat.com/security/cve/CVE-2025-21494
-
report
https://access.redhat.com/security/cve/CVE-2025-21497
-
report
https://access.redhat.com/security/cve/CVE-2025-21500
-
report
https://access.redhat.com/security/cve/CVE-2025-21501
-
report
https://access.redhat.com/security/cve/CVE-2025-21503
-
report
https://access.redhat.com/security/cve/CVE-2025-21504
-
report
https://access.redhat.com/security/cve/CVE-2025-21505
-
report
https://access.redhat.com/security/cve/CVE-2025-21518
-
report
https://access.redhat.com/security/cve/CVE-2025-21519
-
report
https://access.redhat.com/security/cve/CVE-2025-21520
-
report
https://access.redhat.com/security/cve/CVE-2025-21521
-
report
https://access.redhat.com/security/cve/CVE-2025-21522
-
report
https://access.redhat.com/security/cve/CVE-2025-21523