High NCSC-2024-0420 35 CVEs

Kwetsbaarheden verholpen in Oracle MySQL

Published Oct 17, 2024 · Updated Oct 17, 2024 · nl

Vendor: Oracle Product: MySQL Product: MySQL Client Product: MySQL Cluster Product: MySQL Connectors Product: MySQL Enterprise Monitor Product: MySQL Server Product: MySQL Workbench Product: mysql_enterprise_backup

Summary

Oracle heeft kwetsbaarheden verholpen in MySQL.

Details

Interpretaties
Een kwaadwillende kan de kwetsbaarheden misbruiken om een Denial-of-Service te veroorzaken, of om toegang te krijgen tot gevoelige gegevens in de database en deze mogelijk te manipuleren.

Oplossingen
Oracle heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.

Vulnerabilities 35

Critical 9.1

CVE-2024-37371

In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can cause invalid memory reads during GSS message token handlin…

krb5 krb5 krb5 krb5 Debian Ubuntu Azure Linux Alpine

Jun 28, 2024
Critical 9.1

CVE-2024-5535 Public exploit

SSL_select_next_proto buffer overread

Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an empty supported client protocols buffer may cause a crash or memory contents to be sent to the peer. Impact summary: A buffer overread can have a range of potential consequences suc…

OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi

Jun 27, 2024
High 8.8

CVE-2023-45853

pyminizip affected by zlib's integer overflow/heap based buffer overflow vulnerability due to vulnerable dependency

MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product. NOTE: pyminizip through 0.2.6 is a…

qt6-qtwebengine qt5-qtwebengine rust cloud-hypervisor Debian Ubuntu Azure Linux Alpine Wolfi PyPI

Oct 14, 2023
High 7.5

CVE-2024-21272

MySQL Connector/Python connector takeover vulnerability

Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Python). Supported versions that are affected are 9.0.0 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols…

Oracle MySQL Connectors airflow mysql-connector-python Ubuntu Wolfi PyPI

Oct 15, 2024
High 7.5

CVE-2024-39689 Public exploit

Certifi removes GLOBALTRUST root certificate

Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi starting in 2021.5.30 and prior to 2024.7.4 recognized root certificates from `GLOBALTRUST`. Certifi…

certifi python-certifi katib-suggestion-hyperopt katib-earlystopping Debian Wolfi PyPI

Jul 5, 2024
Medium 6.5

CVE-2024-21196

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: X Plugin). Supported versions that are af…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux

Oct 15, 2024
Medium 6.5

CVE-2024-21230

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

Oracle MySQL Server MySQL Cluster percona-server-5.6 Ubuntu Azure Linux

Oct 15, 2024
Medium 6.5

CVE-2024-21262 Public exploit

Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/ODBC). Supported versions that are …

Oracle MySQL Connectors mysql-connector-java Ubuntu

Oct 15, 2024
Medium 6.3

CVE-2024-7264 EPSS 20%

ASN.1 date parser overread

libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an ASN.1 Generalized Time field. If given an syntactically incorrect field, the parser might end up using -1 for the length of the *time fraction*, leading to a `strlen()` getting per…

curl curl curl curl Debian Ubuntu Azure Linux Alpine Wolfi

Jul 31, 2024
Medium 5.3

CVE-2024-21238

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Thread Pooling). Supported versions that …

Oracle MySQL Server MySQL Cluster mysql-5.5 Ubuntu Azure Linux

Oct 15, 2024
Medium 5.3

CVE-2024-28182 EPSS 82%

Reading unbounded number of HTTP/2 CONTINUATION frames to cause excessive CPU usage

nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior to version 1.61.0 keeps reading the unbounded number of HTTP/2 CONTINUATION frames even after a stream is reset to keep HPACK context in sync. This cause…

nghttp2 nghttp2 rust nodejs Debian Ubuntu Azure Linux Wolfi

Apr 4, 2024
Medium 4.9

CVE-2024-21193

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: PS). Supported versions that are affected…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux

Oct 15, 2024
Medium 4.9

CVE-2024-21194

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux

Oct 15, 2024
Medium 4.9

CVE-2024-21197

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema). Supported versions t…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux

Oct 15, 2024
Medium 4.9

CVE-2024-21198

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affecte…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux

Oct 15, 2024
Medium 4.9

CVE-2024-21199

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux

Oct 15, 2024
Medium 4.9

CVE-2024-21200

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu

Oct 15, 2024
Medium 4.9

CVE-2024-21201

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux

Oct 15, 2024
Medium 4.9

CVE-2024-21203

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: FTS). Supported versions that are affecte…

Oracle MySQL Server MySQL Cluster mysql-5.5 Ubuntu Azure Linux

Oct 15, 2024
Medium 4.9

CVE-2024-21204

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: PS). Supported versions that are affected…

Oracle MySQL Server mysql-5.5 mysql-5.7 Ubuntu

Oct 15, 2024
Medium 4.9

CVE-2024-21207

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux

Oct 15, 2024
Medium 4.9

CVE-2024-21218

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

Oracle MySQL Server MySQL Cluster mysql-5.5 Ubuntu Azure Linux

Oct 15, 2024
Medium 4.9

CVE-2024-21219

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affecte…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux

Oct 15, 2024
Medium 4.9

CVE-2024-21236

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux

Oct 15, 2024
Medium 4.9

CVE-2024-21239

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux

Oct 15, 2024
Medium 4.9

CVE-2024-21241

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux

Oct 15, 2024
Medium 4.4

CVE-2024-21212

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Health Monitor). Supported versions that …

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux

Oct 15, 2024
Medium 4.2

CVE-2024-21213

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux

Oct 15, 2024
Low 3.8

CVE-2024-21247

Vulnerability in the MySQL Client product of Oracle MySQL (component: Client: mysqldump). Supported versions that are a…

Oracle MySQL Cluster MySQL Client mysql-5.5 Ubuntu Azure Linux

Oct 15, 2024
Low 3.1

CVE-2024-21231

Vulnerability in the MySQL Server product of Oracle MySQL (component: Client programs). Supported versions that are aff…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux

Oct 15, 2024
Low 2.2

CVE-2024-21232

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Components Services). Supported versions …

Oracle MySQL Server mysql-5.5 mysql-5.7 Ubuntu

Oct 15, 2024
Low 2.2

CVE-2024-21237

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Group Replication GCS). Supported version…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux

Oct 15, 2024
Low 2.2

CVE-2024-21243

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Telemetry). Supported versions that are a…

Oracle MySQL Server mysql-5.5 mysql-5.7 Ubuntu

Oct 15, 2024
Low 2.2

CVE-2024-21244

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Telemetry). Supported versions that are a…

Oracle MySQL Server mysql-5.5 mysql-5.7 Ubuntu

Oct 15, 2024
Low 2.0

CVE-2024-21209

Vulnerability in the MySQL Client product of Oracle MySQL (component: Client: mysqldump). Supported versions that are a…

Oracle MySQL Client mysql-5.5 mysql-5.7 Ubuntu

Oct 15, 2024

Revision history

2024-10-17 #0
Initiele versie

References

Reference - cveprojectv5; hkcert; nvd; oracle; redhat
https://www.oracle.com/security-alerts/cpuoct2024.html