Summary
MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL.
The following packages have been upgraded to a later upstream version: mariadb (10.3). (BZ#2223572, BZ#2223574, BZ#2223962, BZ#2223965)
Security Fix(es):
* mariadb: segmentation fault via the component sub_select (CVE-2022-32084)
* mariadb: server crash in JOIN_CACHE::free or in copy_fields (CVE-2022-32091)
* mariadb: compress_write() fails to release mutex on failure (CVE-2022-38791)
* mariadb: NULL pointer dereference in spider_db_mbase::print_warnings() (CVE-2022-47015)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Bug Fix(es):
* [MariaDB 10.3.32] socat: E Failed to set SNI host "" (SST failure) (BZ#2223961)
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 8 | galera | 0:25.3.37-1.module+el8.8.0+1452+2a7eab68 |
| Rocky Linux · 8 | Judy | 0:1.0.5-18.module+el8.4.0+427+adf35707 |
| Rocky Linux · 8 | Judy | 0:1.0.5-18.module+el8.10.0+1674+fa55eae9 |
| Rocky Linux · 8 | Judy | 0:1.0.5-18.module+el8.10.0+1925+356c22e8 |
| Rocky Linux · 8 | Judy | 0:1.0.5-18.module+el8.4.0+431+26aaed18 |
| Rocky Linux · 8 | mariadb | 3:10.3.39-1.module+el8.8.0+1452+2a7eab68 |
Vulnerabilities 5
-
High 7.5
Mariadb: node crashes with transport endpoint is not connected mysqld got signal 6
A vulnerability was found in MariaDB. An OpenVAS port scan on ports 3306 and 4567 allows a malicious remote client to cause a denial of service.
-
Medium 6.5
MariaDB Server before 10.3.34 thru 10.9.3 is vulnerable to Denial of Service. It is possible for function spider_db_mba…
-
Unscored —
MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component sub_select.
-
Unscored —
MariaDB v10.7 was discovered to contain an use-after-poison in in __interceptor_memset at /libsanitizer/sanitizer_commo…
-
Unscored —
In MariaDB before 10.9.2, compress_write in extra/mariabackup/ds_compress.cc does not release data_mutex upon a stream …