RHSA-2022:1556 — Red Hat Security Advisory: mariadb:10.3 security and bug fix update

Fixed packages 28

Release	Package	Fixed in
Red Hat · RHEL 8 enterprise_linux:8::appstream	galera	0:25.3.34-4.module+el8.5.0+14124+14ced695
Red Hat · RHEL 8 enterprise_linux:8::appstream	galera-debuginfo	0:25.3.34-4.module+el8.5.0+14124+14ced695
Red Hat · RHEL 8 enterprise_linux:8::appstream	galera-debugsource	0:25.3.34-4.module+el8.5.0+14124+14ced695
Red Hat · RHEL 8 enterprise_linux:8::appstream	Judy	0:1.0.5-18.module+el8+2765+cfa4f87b
Red Hat · RHEL 8 enterprise_linux:8::appstream	Judy-debuginfo	0:1.0.5-18.module+el8+2765+cfa4f87b
Red Hat · RHEL 8 enterprise_linux:8::appstream	Judy-debugsource	0:1.0.5-18.module+el8+2765+cfa4f87b
Red Hat · RHEL 8 enterprise_linux:8::appstream	mariadb	3:10.3.32-2.module+el8.5.0+14124+14ced695
Red Hat · RHEL 8 enterprise_linux:8::appstream	mariadb-backup	3:10.3.32-2.module+el8.5.0+14124+14ced695
Red Hat · RHEL 8 enterprise_linux:8::appstream	mariadb-backup-debuginfo	3:10.3.32-2.module+el8.5.0+14124+14ced695
Red Hat · RHEL 8 enterprise_linux:8::appstream	mariadb-common	3:10.3.32-2.module+el8.5.0+14124+14ced695
Red Hat · RHEL 8 enterprise_linux:8::appstream	mariadb-debuginfo	3:10.3.32-2.module+el8.5.0+14124+14ced695
Red Hat · RHEL 8 enterprise_linux:8::appstream	mariadb-debugsource	3:10.3.32-2.module+el8.5.0+14124+14ced695
Red Hat · RHEL 8 enterprise_linux:8::appstream	mariadb-devel	3:10.3.32-2.module+el8.5.0+14124+14ced695
Red Hat · RHEL 8 enterprise_linux:8::appstream	mariadb-embedded	3:10.3.32-2.module+el8.5.0+14124+14ced695
Red Hat · RHEL 8 enterprise_linux:8::appstream	mariadb-embedded-debuginfo	3:10.3.32-2.module+el8.5.0+14124+14ced695
Red Hat · RHEL 8 enterprise_linux:8::appstream	mariadb-embedded-devel	3:10.3.32-2.module+el8.5.0+14124+14ced695
Red Hat · RHEL 8 enterprise_linux:8::appstream	mariadb-errmsg	3:10.3.32-2.module+el8.5.0+14124+14ced695
Red Hat · RHEL 8 enterprise_linux:8::appstream	mariadb-gssapi-server	3:10.3.32-2.module+el8.5.0+14124+14ced695
Red Hat · RHEL 8 enterprise_linux:8::appstream	mariadb-gssapi-server-debuginfo	3:10.3.32-2.module+el8.5.0+14124+14ced695
Red Hat · RHEL 8 enterprise_linux:8::appstream	mariadb-oqgraph-engine	3:10.3.32-2.module+el8.5.0+14124+14ced695
Red Hat · RHEL 8 enterprise_linux:8::appstream	mariadb-oqgraph-engine-debuginfo	3:10.3.32-2.module+el8.5.0+14124+14ced695
Red Hat · RHEL 8 enterprise_linux:8::appstream	mariadb-server	3:10.3.32-2.module+el8.5.0+14124+14ced695
Red Hat · RHEL 8 enterprise_linux:8::appstream	mariadb-server-debuginfo	3:10.3.32-2.module+el8.5.0+14124+14ced695
Red Hat · RHEL 8 enterprise_linux:8::appstream	mariadb-server-galera	3:10.3.32-2.module+el8.5.0+14124+14ced695
Red Hat · RHEL 8 enterprise_linux:8::appstream	mariadb-server-utils	3:10.3.32-2.module+el8.5.0+14124+14ced695
Red Hat · RHEL 8 enterprise_linux:8::appstream	mariadb-server-utils-debuginfo	3:10.3.32-2.module+el8.5.0+14124+14ced695
Red Hat · RHEL 8 enterprise_linux:8::appstream	mariadb-test	3:10.3.32-2.module+el8.5.0+14124+14ced695
Red Hat · RHEL 8 enterprise_linux:8::appstream	mariadb-test-debuginfo	3:10.3.32-2.module+el8.5.0+14124+14ced695

Vulnerabilities 14

Medium 5.9

CVE-2021-2389

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Debian Ubuntu Alpine

Jul 20, 2021
Medium 5.5

CVE-2021-35604

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Debian Ubuntu Alpine

Oct 20, 2021
Medium 5.3

CVE-2022-31621

MariaDB Server before 10.7 is vulnerable to Denial of Service. In extra/mariabackup/ds_xbstream.cc, when an error occur…

mariadb mariadb-10.5 Debian Alpine

May 25, 2022
Medium 4.9

CVE-2021-2154

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affecte…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Debian Ubuntu Alpine

Apr 22, 2021
Medium 4.9

CVE-2021-2166

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affecte…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Debian Ubuntu Alpine

Apr 22, 2021
Medium 4.4

CVE-2021-2372

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Debian Ubuntu Alpine

Jul 20, 2021
Medium 4.4

CVE-2022-21451

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux

Apr 19, 2022
Unscored —

CVE-2021-46657

get_sort_by_table in MariaDB before 10.6.2 allows an application crash via certain subquery uses of ORDER BY.

mariadb-10.3 mariadb-10.5 mariadb Debian Ubuntu Azure Linux

Jan 29, 2022
Unscored —

CVE-2021-46658

save_window_function_values in MariaDB before 10.6.3 allows an application crash because of incorrect handling of with_…

mariadb-10.3 mariadb-10.5 mariadb Debian Ubuntu Azure Linux

Jan 29, 2022
Unscored —

CVE-2021-46662

MariaDB through 10.5.9 allows a set_var.cc application crash via certain uses of an UPDATE statement in conjunction wit…

mariadb-10.3 mariadb mariadb-10.5 mariadb Debian Ubuntu Azure Linux Alpine

Feb 1, 2022
Unscored —

CVE-2021-46666

MariaDB before 10.6.2 allows an application crash because of mishandling of a pushdown from a HAVING clause to a WHERE …

mariadb-10.3 mariadb-10.6 mariadb-10.5 mariadb Debian Ubuntu Azure Linux

Feb 1, 2022
Unscored —

CVE-2021-46667

MariaDB before 10.6.5 has a sql_lex.cc integer overflow, leading to an application crash.

mariadb-10.3 mariadb mariadb-10.5 mariadb Debian Ubuntu Azure Linux Alpine

Feb 1, 2022
Unscored —

CVE-2022-27385

An issue in the component Used_tables_and_const_cache::used_tables_and_const_cache_join of MariaDB Server v10.7 and bel…

mariadb-10.3 mariadb-10.0 mariadb-10.1 mariadb Debian Ubuntu Alpine

Apr 12, 2022
Unscored —

CVE-2022-31624

MariaDB Server before 10.7 is vulnerable to Denial of Service. While executing the plugin/server_audit/server_audit.c m…

mariadb-10.3 mariadb-10.0 mariadb-10.1 mariadb Debian Ubuntu Alpine

May 25, 2022

References

article
https://access.redhat.com/security/updates/classification/#moderate
report
https://bugzilla.redhat.com/show_bug.cgi?id=1951752
report
https://bugzilla.redhat.com/show_bug.cgi?id=1951755
report
https://bugzilla.redhat.com/show_bug.cgi?id=1981332
report
https://bugzilla.redhat.com/show_bug.cgi?id=1992303
report
https://bugzilla.redhat.com/show_bug.cgi?id=1992309
report
https://bugzilla.redhat.com/show_bug.cgi?id=2016101
report
https://bugzilla.redhat.com/show_bug.cgi?id=2049294
report
https://bugzilla.redhat.com/show_bug.cgi?id=2049305
report
https://bugzilla.redhat.com/show_bug.cgi?id=2050019
report
https://bugzilla.redhat.com/show_bug.cgi?id=2050028
report
https://bugzilla.redhat.com/show_bug.cgi?id=2050030
report
https://bugzilla.redhat.com/show_bug.cgi?id=2050514
report
https://bugzilla.redhat.com/show_bug.cgi?id=2050532
report
https://bugzilla.redhat.com/show_bug.cgi?id=2050533
report
https://bugzilla.redhat.com/show_bug.cgi?id=2050543
report
https://bugzilla.redhat.com/show_bug.cgi?id=2050550
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_1556.json
report
https://access.redhat.com/security/cve/CVE-2021-2154
advisory
https://www.cve.org/CVERecord?id=CVE-2021-2154
advisory
https://nvd.nist.gov/vuln/detail/CVE-2021-2154
article
https://www.oracle.com/security-alerts/cpuapr2021.html#AppendixMSQL
report
https://access.redhat.com/security/cve/CVE-2021-2166
advisory
https://www.cve.org/CVERecord?id=CVE-2021-2166
advisory
https://nvd.nist.gov/vuln/detail/CVE-2021-2166
report
https://access.redhat.com/security/cve/CVE-2021-2372
advisory
https://www.cve.org/CVERecord?id=CVE-2021-2372
advisory
https://nvd.nist.gov/vuln/detail/CVE-2021-2372
report
https://access.redhat.com/security/cve/CVE-2021-2389
advisory
https://www.cve.org/CVERecord?id=CVE-2021-2389
advisory
https://nvd.nist.gov/vuln/detail/CVE-2021-2389
report
https://access.redhat.com/security/cve/CVE-2021-35604
advisory
https://www.cve.org/CVERecord?id=CVE-2021-35604
advisory
https://nvd.nist.gov/vuln/detail/CVE-2021-35604
report
https://access.redhat.com/security/cve/CVE-2021-46657
advisory
https://www.cve.org/CVERecord?id=CVE-2021-46657
advisory
https://nvd.nist.gov/vuln/detail/CVE-2021-46657
report
https://access.redhat.com/security/cve/CVE-2021-46658
advisory
https://www.cve.org/CVERecord?id=CVE-2021-46658

Red Hat Security Advisory: mariadb:10.3 security and bug fix update

Fixed packages 28

Vulnerabilities 14

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

MariaDB Server before 10.7 is vulnerable to Denial of Service. In extra/mariabackup/ds_xbstream.cc, when an error occur…

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affecte…

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affecte…

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

get_sort_by_table in MariaDB before 10.6.2 allows an application crash via certain subquery uses of ORDER BY.

save_window_function_values in MariaDB before 10.6.3 allows an application crash because of incorrect handling of with_…

MariaDB through 10.5.9 allows a set_var.cc application crash via certain uses of an UPDATE statement in conjunction wit…

MariaDB before 10.6.2 allows an application crash because of mishandling of a pushdown from a HAVING clause to a WHERE …

MariaDB before 10.6.5 has a sql_lex.cc integer overflow, leading to an application crash.

An issue in the component Used_tables_and_const_cache::used_tables_and_const_cache_join of MariaDB Server v10.7 and bel…

MariaDB Server before 10.7 is vulnerable to Denial of Service. While executing the plugin/server_audit/server_audit.c m…

References