Oracle MySQL: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 21

• Critical 9.1
  CVE-2022-37865

  Apache Ivy allows creating/overwriting any file on the system

  With Apache Ivy 2.4.0 an optional packaging attribute has been introduced that allows artifacts to be unpacked on the fly if they used pack200 or zip packaging. For artifacts using the "zip", "jar" or "war" packaging Ivy prior to 2.5.1 doesn't verify the targ…

  Apache Software Foundation Apache Ivy org.apache.ivy:ivy Maven
  Nov 7, 2022
• High 7.5
  CVE-2022-4899

  zstd vulnerable to buffer overrun

  A vulnerability was found in zstd v1.4.10, where an attacker can supply empty string as an argument to the command line tool to cause buffer overrun.

  libzstd libzstd zstd zstd Debian Ubuntu Azure Linux PyPI SwiftURL
  Mar 31, 2023
• High 7.5
  CVE-2023-24998 Public exploit EPSS 49%

  Apache Commons FileUpload, Apache Tomcat: FileUpload DoS with excessive parts

  Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads. Note that, like all of the file upload limits, the new c…

  Apache Software Foundation Apache Tomcat Apache Commons FileUpload tomcat9 Debian Ubuntu Maven
  Feb 20, 2023
• High 7.5
  CVE-2023-28709 EPSS 48%

  Apache Tomcat: Fix for CVE-2023-24998 is incomplete

  The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-default HTTP connector settings were used such that the maxParameterCount could be reached using query string p…

  Apache Software Foundation Apache Tomcat tomcat10 org.apache.tomcat.embed:tomcat-embed-core Debian Maven
  May 22, 2023
• High 7.4
  CVE-2023-0361

  A timing side-channel in the handling of RSA ClientKeyExchange messages was discovered in GnuTLS. This side-channel can…

  gnutls28 gnutls28 gnutls gnutls Debian Ubuntu Azure Linux Alpine
  Feb 15, 2023
• Medium 6.5
  CVE-2023-2650 EPSS 75%

  Possible DoS translating ASN.1 object identifiers

  Issue summary: Processing some specially crafted ASN.1 object identifiers or data containing them may be very slow. Impact summary: Applications that use OBJ_obj2txt() directly, or use any of the OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with …

  OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  May 30, 2023
• Medium 6.5
  CVE-2023-28484

  In libxml2 before 2.10.4, parsing of certain invalid XSD schemas can lead to a NULL pointer dereference and subsequentl…

  libxml2 libxml2 libxml2 libxml2 Debian Ubuntu Azure Linux Alpine
  Apr 24, 2023
• Medium 6.3
  CVE-2023-20862

  Spring Security logout not clearing security context

  In Spring Security, versions 5.7.x prior to 5.7.8, versions 5.8.x prior to 5.8.3, and versions 6.0.x prior to 6.0.3, the logout support does not properly clean the security context if using serialized versions. Additionally, it is not possible to explicitly s…

  org.springframework.security:spring-security-core Maven
  Apr 19, 2023
• Medium 5.9
  CVE-2023-22053

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Client programs). Supported versions that are aff…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux
  Jul 18, 2023
• Medium 4.9
  CVE-2023-21950

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Jul 18, 2023
• Medium 4.9
  CVE-2023-22007

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Jul 18, 2023
• Medium 4.9
  CVE-2023-22008

  Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux
  Jul 18, 2023
• Medium 4.9
  CVE-2023-22046

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux
  Jul 18, 2023
• Medium 4.9
  CVE-2023-22054

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux
  Jul 18, 2023
• Medium 4.9
  CVE-2023-22056

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux
  Jul 18, 2023
• Medium 4.9
  CVE-2023-22057

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux
  Jul 18, 2023
• Medium 4.4
  CVE-2023-22005

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux
  Jul 18, 2023
• Medium 4.4
  CVE-2023-22033

  Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux
  Jul 18, 2023
• Medium 4.4
  CVE-2023-22058

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affecte…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux
  Jul 18, 2023
• Low 3.1
  CVE-2023-22048

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Pluggable Auth). Supported versions that …

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux
  Jul 18, 2023
• Low 2.7
  CVE-2023-22038

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux
  Jul 18, 2023

Revision history

1. 2024-05-30 #13

   Neue Updates von Red Hat aufgenommen

2. 2024-05-01 #12

   Neue Updates von Red Hat aufgenommen

3. 2024-03-07 #11

   Neue Updates von Oracle Linux aufgenommen

4. 2024-03-05 #10

   Neue Updates von Red Hat aufgenommen

5. 2024-03-03 #9

   Neue Updates von XEROX aufgenommen

6. 2024-02-21 #8

   Neue Updates von Oracle Linux aufgenommen

7. 2024-02-20 #7

   Neue Updates von Red Hat aufgenommen

8. 2023-12-12 #6

   Neue Updates von IBM aufgenommen

9. 2023-11-05 #5

   Neue Updates von Amazon aufgenommen

10. 2023-10-24 #4

    Neue Updates von Ubuntu aufgenommen

11. 2023-09-07 #3

    Neue Updates von Fedora aufgenommen

12. 2023-08-15 #2

    Neue Updates von Ubuntu aufgenommen

13. 2023-07-18 #1

    Initiale Fassung

References

• IBM Security Bulletin 7095695 vom 2023-12-12
  https://www.ibm.com/support/pages/node/7095695
• Red Hat Security Advisory RHSA-2024:1141 vom 2024-03-06
  https://access.redhat.com/errata/RHSA-2024:1141
• Oracle Critical Patch Update Advisory - July 2023 - Appendix Oracle MySQL vom 2023-07-18
  https://www.oracle.com/security-alerts/cpujul2023.html#AppendixMSQL
• Ubuntu Security Notice USN-6288-1 vom 2023-08-15
  https://ubuntu.com/security/notices/USN-6288-1
• Red Hat Security Advisory RHSA-2024:0894 vom 2024-02-20
  https://access.redhat.com/errata/RHSA-2024:0894
• Fedora Security Advisory FEDORA-2023-492105ED08 vom 2023-09-07
  https://bodhi.fedoraproject.org/updates/FEDORA-2023-492105ed08
• Fedora Security Advisory FEDORA-2023-9CCFF0B1B7 vom 2023-09-07
  https://bodhi.fedoraproject.org/updates/FEDORA-2023-9ccff0b1b7
• Fedora Security Advisory FEDORA-2023-A9283D639F vom 2023-09-07
  https://bodhi.fedoraproject.org/updates/FEDORA-2023-a9283d639f
• Oracle Linux Security Advisory ELSA-2024-1141 vom 2024-03-07
  http://linux.oracle.com/errata/ELSA-2024-1141.html
• Oracle Linux Security Advisory ELSA-2024-0894 vom 2024-02-22
  https://linux.oracle.com/errata/ELSA-2024-0894.html
• XEROX Security Advisory XRX24-005 vom 2024-03-04
  https://security.business.xerox.com/wp-content/uploads/2024/03/Xerox-Security-Bulletin-XRX24-005-Xerox-FreeFlow%C2%AE-Print-Server-v9_Feb-2024.pdf
• Ubuntu Security Notice USN-6288-2 vom 2023-10-24
  https://ubuntu.com/security/notices/USN-6288-2
• Amazon Linux Security Advisory ALAS-2023-1878 vom 2023-11-03
  https://alas.aws.amazon.com/ALAS-2023-1878.html
• Red Hat Security Advisory RHSA-2024:2619 vom 2024-04-30
  https://access.redhat.com/errata/RHSA-2024:2619
• Red Hat Security Advisory RHSA-2024:3527 vom 2024-05-30
  https://access.redhat.com/errata/RHSA-2024:3527