High 1 exploited CVE WID-SEC-2023-0065 48 CVEs

Oracle MySQL: Mehrere Schwachstellen

Published Apr 20, 2021 · Updated Sep 27, 2023 · Revision 19 · de-DE

Vendor: amazon Vendor: gentoo Vendor: Juniper Networks Vendor: MariaDB Vendor: Oracle Vendor: Red Hat Vendor: SUSE Vendor: Ubuntu Product: Contrail Service Orchestration Product: Enterprise Linux Product: Linux Product: Linux Product: Linux Product: Linux Product: Linux 2 Product: MariaDB Product: MariaDB < 10.2.38 Product: MariaDB < 10.3.29 Product: MySQL Product: MySQL <= 5.7.33 Product: MySQL <= 8.0.23 Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle MySQL ausnutzen, um die Verfügbarkeit, Vertraulichkeit und Integrität zu gefährden.

Product

MySQL ist ein Open Source Datenbankserver von Oracle.

Vulnerabilities 48

Critical 9.8

CVE-2020-17530 Exploited Public exploit Scanner template EPSS 96%

Remote code execution in Apache Struts

Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software : Apache Struts 2.0.0 - Struts 2.5.25.

Apache Software Foundation Apache Struts org.apache.struts:struts2-core Maven

Dec 11, 2020
KEV Nov 3, 2021
High 7.5

CVE-2020-17527 Public exploit EPSS 25%

Apache Tomcat: Request header mix-up between HTTP/2 streams

While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated wi…

Apache Software Foundation Apache Tomcat tomcat8 tomcat9 Debian Ubuntu Azure Linux Maven

Dec 3, 2020
High 7.5

CVE-2020-28196

MIT Kerberos 5 (aka krb5) before 1.17.2 and 1.18.x before 1.18.3 allows unbounded recursion via an ASN.1-encoded Kerber…

krb5 krb5 krb5 Debian Ubuntu Alpine

Nov 6, 2020
High 7.4

CVE-2021-3450 Public exploit EPSS 18%

CA certificate check bypass with X509_V_FLAG_X509_STRICT

The X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a certificate chain. It is not set by default. Starting from OpenSSL version 1.1.1h a check to disallow certificates in the chain that have explicitly encoded e…

OpenSSL OpenSSL openssl openssl Debian Alpine crates.io

Mar 25, 2021
High 7.2

CVE-2021-2144

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser). Supported versions that are affe…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu

Apr 22, 2021
Medium 6.5

CVE-2021-2172

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affecte…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu

Apr 22, 2021
Medium 6.5

CVE-2021-2178

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu

Apr 22, 2021
Medium 6.5

CVE-2021-2202

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu

Apr 22, 2021
Medium 6.5

CVE-2021-2298

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu

Apr 22, 2021
Medium 6.1

CVE-2021-2307

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Packaging). Supported versions that are a…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu

Apr 22, 2021
Medium 5.9

CVE-2020-1971 Public exploit

EDIPARTYNAME NULL pointer dereference

The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a function GENERAL_NAME_cmp which compares different instances of a GENERAL_NAME to see if they are equa…

OpenSSL OpenSSL openssl openssl Debian Ubuntu Alpine

Dec 8, 2020
Medium 5.9

CVE-2021-23841 Public exploit

Null pointer deref in X509_issuer_and_serial_hash()

The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate. However it fails to correctly handle any errors that may occur while parsing …

OpenSSL OpenSSL openssl openssl Debian Ubuntu Azure Linux Alpine crates.io

Feb 16, 2021
Medium 5.9

CVE-2021-3449 Public exploit EPSS 64%

NULL pointer deref in signature_algorithms processing

An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a si…

OpenSSL OpenSSL openssl openssl Debian Ubuntu Alpine crates.io

Mar 25, 2021
Medium 5.5

CVE-2021-2304

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure). Supported versions tha…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu

Apr 22, 2021
Medium 5.3

CVE-2019-7317

png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called un…

thunderbird firefox thunderbird firefox-esr Debian Ubuntu Azure Linux Alpine Wolfi

Feb 4, 2019
Medium 4.9

CVE-2021-2146

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Options). Supported versions that are aff…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu

Apr 22, 2021
Medium 4.9

CVE-2021-2154

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affecte…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Debian Ubuntu Alpine

Apr 22, 2021
Medium 4.9

CVE-2021-2160

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu

Apr 22, 2021
Medium 4.9

CVE-2021-2164

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu

Apr 22, 2021
Medium 4.9

CVE-2021-2166

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affecte…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Debian Ubuntu Alpine

Apr 22, 2021
Medium 4.9

CVE-2021-2169

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu

Apr 22, 2021
Medium 4.9

CVE-2021-2170

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu

Apr 22, 2021
Medium 4.9

CVE-2021-2179

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Group Replication Plugin). Supported vers…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu

Apr 22, 2021
Medium 4.9

CVE-2021-2180

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu

Apr 22, 2021
Medium 4.9

CVE-2021-2193

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu

Apr 22, 2021
Medium 4.9

CVE-2021-2194

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Debian Ubuntu

Apr 22, 2021
Medium 4.9

CVE-2021-2196

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affecte…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu

Apr 22, 2021
Medium 4.9

CVE-2021-2201

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Partition). Supported versions that are a…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu

Apr 22, 2021
Medium 4.9

CVE-2021-2203

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu

Apr 22, 2021
Medium 4.9

CVE-2021-2208

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Partition). Supported versions that are a…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu

Apr 22, 2021
Medium 4.9

CVE-2021-2212

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu

Apr 22, 2021
Medium 4.9

CVE-2021-2213

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu

Apr 22, 2021
Medium 4.9

CVE-2021-2215

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure). Supported versions tha…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu

Apr 22, 2021
Medium 4.9

CVE-2021-2217

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure). Supported versions tha…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu

Apr 22, 2021
Medium 4.9

CVE-2021-2226

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema). Supported versions t…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu

Apr 22, 2021
Medium 4.9

CVE-2021-2230

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu

Apr 22, 2021
Medium 4.9

CVE-2021-2278

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu

Apr 22, 2021
Medium 4.9

CVE-2021-2293

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure). Supported versions tha…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu

Apr 22, 2021
Medium 4.9

CVE-2021-2299

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu

Apr 22, 2021
Medium 4.9

CVE-2021-2300

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affecte…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu

Apr 22, 2021
Medium 4.9

CVE-2021-2305

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affecte…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu

Apr 22, 2021
Medium 4.4

CVE-2021-2171

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu

Apr 22, 2021
Medium 4.4

CVE-2021-2174

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu

Apr 22, 2021
Medium 4.3

CVE-2021-2162

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Audit Plug-in). Supported versions that a…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu

Apr 22, 2021
Low 2.7

CVE-2021-2301

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema). Supported versions t…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu

Apr 22, 2021
Low 2.7

CVE-2021-2308

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema). Supported versions t…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu

Apr 22, 2021
Low 1.9

CVE-2021-2232

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Group Replication Plugin). Supported vers…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu

Apr 22, 2021
Unscored —

CVE-2020-8277 Public exploit EPSS 54%

A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denia…

Node.js node nodejs nodejs-current Debian Azure Linux Alpine

Nov 19, 2020

Revision history

2023-09-27 #19
Neue Updates von Amazon aufgenommen
2023-02-22 #18
Neue Updates von Amazon aufgenommen
2023-01-11 #17
Neue Updates von Juniper aufgenommen
2022-05-03 #16
Neue Updates von Oracle Linux aufgenommen
2022-04-27 #15
Neue Updates von Oracle Linux aufgenommen
2022-04-26 #14
Neue Updates von Red Hat aufgenommen
2021-10-12 #13
Neue Updates von Red Hat aufgenommen
2021-10-07 #12
Neue Updates von Ubuntu aufgenommen
2021-09-22 #11
Neue Updates von Oracle Linux aufgenommen
2021-09-20 #10
Neue Updates von Red Hat aufgenommen
2021-08-08 #9
Neue Updates von SUSE aufgenommen
2021-08-05 #8
Neue Updates von SUSE aufgenommen
2021-08-04 #7
Neue Updates von SUSE aufgenommen
2021-05-25 #6
Neue Updates von Gentoo aufgenommen
2021-05-19 #5
Neue Updates von Arch Linux aufgenommen
2021-05-13 #4
Neue Updates von Ubuntu aufgenommen
2021-05-06 #3
Neue Updates aufgenommen
2021-05-05 #2
Neue Updates aufgenommen
2021-04-20 #1
Initiale Fassung

References

Amazon Linux Security Advisory ALASMARIADB10.5-2023-004 vom 2023-09-27
https://alas.aws.amazon.com/AL2/ALASMARIADB10.5-2023-004.html
MariaDB 10.2.38 Release Notes
https://mariadb.com/kb/en/mdb-10238-rn/
MariaDB 10.3.29 Release Notes
https://mariadb.com/kb/en/mariadb-10329-release-notes/
MariaDB 10.5.10 Release Notes
https://mariadb.com/kb/en/mariadb-10510-release-notes/
MariaDB 10.4.19 Release Notes
https://mariadb.com/kb/en/mariadb-10419-release-notes/
Ubuntu Security Notice USN-4952-1 vom 2021-05-14
https://ubuntu.com/security/notices/USN-4952-1
Arch Linux Security Advisory ASA-202105-14 vom 2021-05-19
https://www.cybersecurity-help.cz/vdb/SB2021051922
Oracle Critical Patch Update Advisory - April 2021 - Appendix Oracle MySQL vom 2021-04-20
https://www.oracle.com/security-alerts/cpuapr2021.html#AppendixMSQL
Gentoo Linux Security Advisory GLSA-202105-27 vom 2021-05-26
https://security.gentoo.org/glsa/202105-27
SUSE Security Update SUSE-SU-2021:2605-1 vom 2021-08-04
https://lists.suse.com/pipermail/sle-security-updates/2021-August/009249.html
SUSE Security Update SUSE-SU-2021:2617-1 vom 2021-08-05
https://lists.suse.com/pipermail/sle-security-updates/2021-August/009251.html
SUSE Security Update SUSE-SU-2021:2616-1 vom 2021-08-05
https://lists.suse.com/pipermail/sle-security-updates/2021-August/009258.html
SUSE Security Update SUSE-SU-2021:2634-1 vom 2021-08-06
https://lists.suse.com/pipermail/sle-security-updates/2021-August/009263.html
Red Hat Security Advisory RHSA-2021:3590 vom 2021-09-21
https://access.redhat.com/errata/RHSA-2021:3590
Oracle Linux Security Advisory ELSA-2021-3590 vom 2021-09-23
http://linux.oracle.com/errata/ELSA-2021-3590.html
Ubuntu Security Notice USN-5022-3 vom 2021-10-07
https://ubuntu.com/security/notices/USN-5022-3
Red Hat Security Advisory RHSA-2021:3811 vom 2021-10-12
https://access.redhat.com/errata/RHSA-2021:3811
Red Hat Security Advisory RHSA-2022:1556 vom 2022-04-27
https://access.redhat.com/errata/RHSA-2022:1556
Red Hat Security Advisory RHSA-2022:1557 vom 2022-04-27
https://access.redhat.com/errata/RHSA-2022:1557
Oracle Linux Security Advisory ELSA-2022-1556 vom 2022-04-27
https://linux.oracle.com/errata/ELSA-2022-1556.html
Oracle Linux Security Advisory ELSA-2022-1557 vom 2022-05-03
http://linux.oracle.com/errata/ELSA-2022-1557.html
Juniper Security Advisory JSA70182 vom 2023-01-12
https://supportportal.juniper.net/s/article/2023-01-Security-Bulletin-Contrail-Service-Orchestration-Multiple-vulnerabilities-resolved-in-CSO-6-3-0?language=en_US
Amazon Linux Security Advisory ALAS-2023-1686 vom 2023-02-23
https://alas.aws.amazon.com/ALAS-2023-1686.html