ELSA-2023-5259 — Moderate: mariadb:10.3 security, bug fix, and enhancement update (Oracle Linux 8)

Summary

galera
[25.3.37-1]
- Rebase to 25.3.37

Judy
[1.0.5-18.0.1]
- Rebuild [Orabug: 31667911]

mariadb
[3:10.3.39-1]
- [MariaDB 10.3.32] socat: E Failed to set SNI host '' (SST failure)
- Rebase to 10.3.39
- CVEs fixed:
CVE-2022-47015, CVE-2018-25032, CVE-2022-32091, CVE-2022-32084

Fixed packages 15

Release	Package	Fixed in
Oracle Linux · 8	galera	0:25.3.37-1.module+el8.8.0+21165+f6462f70
Oracle Linux · 8	Judy	0:1.0.5-18.0.1.module+el8.3.0+9616+7a81225f
Oracle Linux · 8	mariadb	3:10.3.39-1.module+el8.8.0+21165+f6462f70
Oracle Linux · 8	mariadb-backup	3:10.3.39-1.module+el8.8.0+21165+f6462f70
Oracle Linux · 8	mariadb-common	3:10.3.39-1.module+el8.8.0+21165+f6462f70
Oracle Linux · 8	mariadb-devel	3:10.3.39-1.module+el8.8.0+21165+f6462f70
Oracle Linux · 8	mariadb-embedded	3:10.3.39-1.module+el8.8.0+21165+f6462f70
Oracle Linux · 8	mariadb-embedded-devel	3:10.3.39-1.module+el8.8.0+21165+f6462f70
Oracle Linux · 8	mariadb-errmsg	3:10.3.39-1.module+el8.8.0+21165+f6462f70
Oracle Linux · 8	mariadb-gssapi-server	3:10.3.39-1.module+el8.8.0+21165+f6462f70
Oracle Linux · 8	mariadb-oqgraph-engine	3:10.3.39-1.module+el8.8.0+21165+f6462f70
Oracle Linux · 8	mariadb-server	3:10.3.39-1.module+el8.8.0+21165+f6462f70
Oracle Linux · 8	mariadb-server-galera	3:10.3.39-1.module+el8.8.0+21165+f6462f70
Oracle Linux · 8	mariadb-server-utils	3:10.3.39-1.module+el8.8.0+21165+f6462f70
Oracle Linux · 8	mariadb-test	3:10.3.39-1.module+el8.8.0+21165+f6462f70

Vulnerabilities 4

Medium 6.5

CVE-2022-47015

MariaDB Server before 10.3.34 thru 10.9.3 is vulnerable to Denial of Service. It is possible for function spider_db_mba…

mariadb-10.3 mariadb-10.6 mariadb mariadb Debian Ubuntu Azure Linux Alpine

Jan 20, 2023
Unscored —

CVE-2022-32084

MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component sub_select.

mariadb-10.3 mariadb-10.0 mariadb-10.1 mariadb-10.6 Debian Ubuntu Alpine

Jul 1, 2022
Unscored —

CVE-2022-32091

MariaDB v10.7 was discovered to contain an use-after-poison in in __interceptor_memset at /libsanitizer/sanitizer_commo…

mariadb-10.3 mariadb-10.0 mariadb-10.1 mariadb-10.6 Debian Ubuntu Azure Linux Alpine

Jul 1, 2022
Unscored —

CVE-2022-38791

In MariaDB before 10.9.2, compress_write in extra/mariabackup/ds_compress.cc does not release data_mutex upon a stream …

mariadb-10.3 mariadb-10.0 mariadb-10.1 mariadb-10.6 Debian Ubuntu

Aug 27, 2022

Moderate: mariadb:10.3 security, bug fix, and enhancement update (Oracle Linux 8)

Summary

Fixed packages 15

Vulnerabilities 4

MariaDB Server before 10.3.34 thru 10.9.3 is vulnerable to Denial of Service. It is possible for function spider_db_mba…

MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component sub_select.

MariaDB v10.7 was discovered to contain an use-after-poison in in __interceptor_memset at /libsanitizer/sanitizer_commo…

In MariaDB before 10.9.2, compress_write in extra/mariabackup/ds_compress.cc does not release data_mutex upon a stream …