Red Hat Security Advisory: mariadb:10.3 security and bug fix update

Fixed packages 28

Vulnerabilities 14

• Medium 5.9
  CVE-2021-2389

  Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Debian Ubuntu Alpine
  Jul 20, 2021
• Medium 5.5
  CVE-2021-35604

  Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Debian Ubuntu Alpine
  Oct 20, 2021
• Medium 5.3
  CVE-2022-31621

  MariaDB Server before 10.7 is vulnerable to Denial of Service. In extra/mariabackup/ds_xbstream.cc, when an error occur…

  mariadb mariadb-10.5 Debian Alpine
  May 25, 2022
• Medium 4.9
  CVE-2021-2154

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affecte…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Debian Ubuntu Alpine
  Apr 22, 2021
• Medium 4.9
  CVE-2021-2166

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affecte…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Debian Ubuntu Alpine
  Apr 22, 2021
• Medium 4.4
  CVE-2021-2372

  Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Debian Ubuntu Alpine
  Jul 20, 2021
• Medium 4.4
  CVE-2022-21451

  Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux
  Apr 19, 2022
• Unscored —
  CVE-2021-46657

  get_sort_by_table in MariaDB before 10.6.2 allows an application crash via certain subquery uses of ORDER BY.

  mariadb-10.3 mariadb-10.5 mariadb Debian Ubuntu Azure Linux
  Jan 29, 2022
• Unscored —
  CVE-2021-46658

  save_window_function_values in MariaDB before 10.6.3 allows an application crash because of incorrect handling of with_…

  mariadb-10.3 mariadb-10.5 mariadb Debian Ubuntu Azure Linux
  Jan 29, 2022
• Unscored —
  CVE-2021-46662

  MariaDB through 10.5.9 allows a set_var.cc application crash via certain uses of an UPDATE statement in conjunction wit…

  mariadb-10.3 mariadb mariadb-10.5 mariadb Debian Ubuntu Azure Linux Alpine
  Feb 1, 2022
• Unscored —
  CVE-2021-46666

  MariaDB before 10.6.2 allows an application crash because of mishandling of a pushdown from a HAVING clause to a WHERE …

  mariadb-10.3 mariadb-10.6 mariadb-10.5 mariadb Debian Ubuntu Azure Linux
  Feb 1, 2022
• Unscored —
  CVE-2021-46667

  MariaDB before 10.6.5 has a sql_lex.cc integer overflow, leading to an application crash.

  mariadb-10.3 mariadb mariadb-10.5 mariadb Debian Ubuntu Azure Linux Alpine
  Feb 1, 2022
• Unscored —
  CVE-2022-27385

  An issue in the component Used_tables_and_const_cache::used_tables_and_const_cache_join of MariaDB Server v10.7 and bel…

  mariadb-10.3 mariadb-10.0 mariadb-10.1 mariadb Debian Ubuntu Alpine
  Apr 12, 2022
• Unscored —
  CVE-2022-31624

  MariaDB Server before 10.7 is vulnerable to Denial of Service. While executing the plugin/server_audit/server_audit.c m…

  mariadb-10.3 mariadb-10.0 mariadb-10.1 mariadb Debian Ubuntu Alpine
  May 25, 2022

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1951752
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1951755
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1981332
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1992303
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1992309
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2016101
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2049294
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2049305
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2050019
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2050028
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2050030
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2075001
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2077509
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2079855
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2079858
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2079859
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2080159
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2081362
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_4818.json
• report
  https://access.redhat.com/security/cve/CVE-2021-2154
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-2154
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-2154
• article
  https://www.oracle.com/security-alerts/cpuapr2021.html#AppendixMSQL
• report
  https://access.redhat.com/security/cve/CVE-2021-2166
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-2166
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-2166
• report
  https://access.redhat.com/security/cve/CVE-2021-2372
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-2372
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-2372
• report
  https://access.redhat.com/security/cve/CVE-2021-2389
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-2389
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-2389
• report
  https://access.redhat.com/security/cve/CVE-2021-35604
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-35604
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-35604
• report
  https://access.redhat.com/security/cve/CVE-2021-46657
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-46657
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-46657