Oracle MySQL: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 35

• Critical 9.1
  CVE-2023-34034 Public exploit

  Access Control Bypass in Spring Security

  Using "**" as a pattern in Spring Security configuration for WebFlux creates a mismatch in pattern matching between Spring Security and Spring WebFlux, and the potential for a security bypass.

  org.springframework.security:spring-security-config Maven
  Jul 19, 2023
• High 8.8
  CVE-2022-42898

  PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to …

  samba krb5 samba samba Debian Ubuntu Azure Linux Alpine
  Dec 25, 2022
• High 8.8
  CVE-2023-38545 Public exploit EPSS 78%

  This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake. When curl is asked to pass along the h…

  curl curl curl curl Debian Ubuntu Azure Linux Alpine Wolfi
  Oct 18, 2023
• High 8.3
  CVE-2023-22102

  MySQL Connectors takeover vulnerability

  Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.1.0 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to …

  Oracle MySQL Connectors mysql-5.5 mysql Ubuntu Azure Linux Wolfi Maven
  Oct 17, 2023
• High 7.9
  CVE-2023-22094

  Vulnerability in the MySQL Installer product of Oracle MySQL (component: Installer: General). Supported versions that a…

  Oracle MySQL Installer mysql-5.5 Ubuntu
  Oct 17, 2023
• Medium 6.5
  CVE-2023-20863

  Spring Framework vulnerable to denial of service

  In spring framework versions prior to 5.2.24 release+ ,5.3.27+ and 6.0.8+ , it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.

  libspring-java libspring-java org.springframework:spring-expression Debian Ubuntu Maven
  Apr 13, 2023
• Medium 6.5
  CVE-2023-22059

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux
  Oct 17, 2023
• Medium 6.5
  CVE-2023-22079

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux
  Oct 17, 2023
• Medium 6.5
  CVE-2023-22095

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). The supported version that is…

  Oracle MySQL Server mysql-5.5 Ubuntu
  Oct 17, 2023
• Medium 6.5
  CVE-2023-2650 EPSS 75%

  Possible DoS translating ASN.1 object identifiers

  Issue summary: Processing some specially crafted ASN.1 object identifiers or data containing them may be very slow. Impact summary: Applications that use OBJ_obj2txt() directly, or use any of the OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with …

  OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  May 30, 2023
• Medium 6.1
  CVE-2023-41080 Public exploit

  Apache Tomcat: Open redirect with FORM authentication

  URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.0.12, from 9.0.0-M1 through 9.0.79 and from 8.5.0 thr…

  Apache Software Foundation Apache Tomcat org.apache.tomcat:tomcat tomcat9 Debian Ubuntu Maven
  Aug 25, 2023
• Medium 5.5
  CVE-2023-2976

  Use of temporary directory for file creation in `FileBackedOutputStream` in Guava

  Use of Java's default temporary directory for file creation in `FileBackedOutputStream` in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with access to the default Java temporary di…

  Google Guava celeborn-0.6 trino-plugin-clickhouse Debian Ubuntu Azure Linux Wolfi Maven
  Jun 14, 2023
• Medium 5.3
  CVE-2023-3817

  Excessive time spent checking DH q parameter value

  Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the k…

  OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Jul 31, 2023
• Medium 4.9
  CVE-2023-22015

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Oct 17, 2023
• Medium 4.9
  CVE-2023-22026

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Oct 17, 2023
• Medium 4.9
  CVE-2023-22028

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Oct 17, 2023
• Medium 4.9
  CVE-2023-22032

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux
  Oct 17, 2023
• Medium 4.9
  CVE-2023-22064

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux
  Oct 17, 2023
• Medium 4.9
  CVE-2023-22065

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux
  Oct 17, 2023
• Medium 4.9
  CVE-2023-22066

  Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux
  Oct 17, 2023
• Medium 4.9
  CVE-2023-22068

  Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux
  Oct 17, 2023
• Medium 4.9
  CVE-2023-22070

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux
  Oct 17, 2023
• Medium 4.9
  CVE-2023-22078

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux
  Oct 17, 2023
• Medium 4.9
  CVE-2023-22084

  Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Debian Ubuntu Azure Linux Alpine
  Oct 17, 2023
• Medium 4.9
  CVE-2023-22092

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux
  Oct 17, 2023
• Medium 4.9
  CVE-2023-22097

  Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux
  Oct 17, 2023
• Medium 4.9
  CVE-2023-22103

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux
  Oct 17, 2023
• Medium 4.9
  CVE-2023-22104

  Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Oct 17, 2023
• Medium 4.9
  CVE-2023-22110

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux
  Oct 17, 2023
• Medium 4.9
  CVE-2023-22111

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: UDF). Supported versions that are affecte…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux
  Oct 17, 2023
• Medium 4.9
  CVE-2023-22112

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux
  Oct 17, 2023
• Medium 4.9
  CVE-2023-22114

  Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux
  Oct 17, 2023
• Medium 4.9
  CVE-2023-22115

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affecte…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux
  Oct 17, 2023
• Medium 4.3
  CVE-2023-34396

  Apache Struts: DoS via OOM owing to no sanity limit on normal form fields in multipart forms

  Allocation of Resources Without Limits or Throttling vulnerability in Apache Software Foundation Apache Struts.This issue affects Apache Struts: through 2.5.30, through 6.1.2. Upgrade to Struts 2.5.31 or 6.1.2.1 or greater

  Apache Software Foundation Apache Struts org.apache.struts:struts2-core struts:struts Maven
  Jun 14, 2023
• Low 2.7
  CVE-2023-22113

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Encryption). Supported versions…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux
  Oct 17, 2023

Revision history

1. 2026-05-05 #26

   Neue Updates von NetApp aufgenommen

2. 2026-01-25 #25

   Neue Updates von Dell aufgenommen

3. 2025-02-13 #24

   Neue Updates von Rocky Enterprise Software Foundation aufgenommen

4. 2025-02-05 #23

   Neue Updates von Oracle Linux aufgenommen

5. 2025-01-29 #22

   Neue Updates von Oracle Linux aufgenommen

6. 2025-01-27 #21

   Neue Updates von Red Hat aufgenommen

7. 2024-06-11 #20

   Neue Updates von SUSE aufgenommen

8. 2024-06-04 #19

   Neue Updates von SUSE aufgenommen

9. 2024-05-14 #18

   Neue Updates aufgenommen

10. 2024-05-01 #17

    Neue Updates von Red Hat aufgenommen

11. 2024-03-07 #16

    Neue Updates von Oracle Linux aufgenommen

12. 2024-03-05 #15

    Neue Updates von Red Hat aufgenommen

13. 2024-03-03 #14

    Neue Updates von XEROX aufgenommen

14. 2024-02-21 #13

    Neue Updates von Oracle Linux aufgenommen

15. 2024-02-20 #12

    Neue Updates von Red Hat aufgenommen

16. 2024-02-12 #11

    Neue Updates von Red Hat aufgenommen

17. 2024-02-01 #10

    Neue Updates von IBM aufgenommen

18. 2024-01-28 #9

    Neue Updates von Debian aufgenommen

19. 2024-01-25 #8

    Neue Updates von Ubuntu aufgenommen

20. 2024-01-24 #7

    Neue Updates von Amazon aufgenommen

21. 2024-01-15 #6

    Neue Updates von Ubuntu aufgenommen

22. 2023-12-19 #5

    Neue Updates von SUSE aufgenommen

23. 2023-11-16 #4

    Neue Updates von Fedora aufgenommen

24. 2023-11-14 #3

    Neue Updates aufgenommen

25. 2023-10-30 #2

    Neue Updates von Ubuntu aufgenommen

References

• Oracle Critical Patch Update Advisory - October 2023 - Appendix Oracle MySQL vom 2023-10-17
  https://www.oracle.com/security-alerts/cpuoct2023.html#AppendixMSQL
• Ubuntu Security Notice USN-6459-1 vom 2023-10-30
  https://ubuntu.com/security/notices/USN-6459-1
• MariaDB Release Notes vom 2023-11-14
  https://mariadb.com/kb/en/mariadb-10-10-7-release-notes/
• MariaDB Release Notes vom 2023-11-14
  https://mariadb.com/kb/en/mariadb-10-4-32-release-notes/
• MariaDB Release Notes vom 2023-11-14
  https://mariadb.com/kb/en/mariadb-10-11-6-release-notes/
• MariaDB Release Notes vom 2023-11-14
  https://mariadb.com/kb/en/mariadb-11-2-2-release-notes/
• MariaDB Release Notes vom 2023-11-14
  https://mariadb.com/kb/en/mariadb-10-6-16-release-notes/
• MariaDB Release Notes vom 2023-11-14
  https://mariadb.com/kb/en/mariadb-10-5-23-release-notes/
• Fedora Security Advisory FEDORA-2023-7FE02EC473 vom 2023-11-17
  https://bodhi.fedoraproject.org/updates/FEDORA-2023-7fe02ec473
• Fedora Security Advisory FEDORA-2023-BFF42B29EB vom 2023-11-17
  https://bodhi.fedoraproject.org/updates/FEDORA-2023-bff42b29eb
• Fedora Security Advisory FEDORA-2023-2ECA0BAACE vom 2023-11-17
  https://bodhi.fedoraproject.org/updates/FEDORA-2023-2eca0baace
• SUSE Security Update SUSE-SU-2023:4908-1 vom 2023-12-20
  https://lists.suse.com/pipermail/sle-security-updates/2023-December/017489.html
• SUSE Security Update SUSE-SU-2023:4907-1 vom 2023-12-20
  https://lists.suse.com/pipermail/sle-security-updates/2023-December/017490.html
• Ubuntu Security Notice USN-6583-1 vom 2024-01-15
  https://ubuntu.com/security/notices/USN-6583-1
• Amazon Linux Security Advisory ALASMARIADB10.5-2024-005 vom 2024-01-24
  https://alas.aws.amazon.com/AL2/ALASMARIADB10.5-2024-005.html
• Ubuntu Security Notice USN-6600-1 vom 2024-01-25
  https://www.cybersecurity-help.cz/vdb/SB2024012551
• Debian Security Advisory DLA-3722 vom 2024-01-27
  https://lists.debian.org/debian-lts-announce/2024/01/msg00017.html
• IBM Security Bulletin 7114078 vom 2024-02-01
  https://www.ibm.com/support/pages/node/7114078
• Red Hat Security Advisory RHSA-2024:0722 vom 2024-02-12
  https://access.redhat.com/errata/RHSA-2024:0722
• Red Hat Security Advisory RHSA-2024:0894 vom 2024-02-20
  https://access.redhat.com/errata/RHSA-2024:0894
• Oracle Linux Security Advisory ELSA-2024-0894 vom 2024-02-22
  https://linux.oracle.com/errata/ELSA-2024-0894.html
• XEROX Security Advisory XRX24-004 vom 2024-03-04
  https://security.business.xerox.com/wp-content/uploads/2024/03/Xerox%C2%AE-Security-Bulletin-XRX24-004-Xerox%C2%AE-FreeFlow%C2%AE-Print-Server-v7.pdf
• XEROX Security Advisory XRX24-005 vom 2024-03-04
  https://security.business.xerox.com/wp-content/uploads/2024/03/Xerox-Security-Bulletin-XRX24-005-Xerox-FreeFlow%C2%AE-Print-Server-v9_Feb-2024.pdf
• Red Hat Security Advisory RHSA-2024:1141 vom 2024-03-06
  https://access.redhat.com/errata/RHSA-2024:1141
• Oracle Linux Security Advisory ELSA-2024-1141 vom 2024-03-07
  http://linux.oracle.com/errata/ELSA-2024-1141.html
• Red Hat Security Advisory RHSA-2024:2619 vom 2024-04-30
  https://access.redhat.com/errata/RHSA-2024:2619
• ### vom 2024-05-14
  https://docs.camunda.org/security/notices/#notice-110
• SUSE Security Update SUSE-SU-2024:1922-1 vom 2024-06-04
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/F2AWFFUP473KIHYZ3F5RZPNY2PZBOZ2P/
• SUSE Security Update SUSE-SU-2024:1985-1 vom 2024-06-11
  https://lists.suse.com/pipermail/sle-security-updates/2024-June/018698.html
• Red Hat Security Advisory RHSA-2025:0739 vom 2025-01-28
  https://access.redhat.com/errata/RHSA-2025:0739
• Oracle Linux Security Advisory ELSA-2025-0739 vom 2025-01-30
  https://linux.oracle.com/errata/ELSA-2025-0739.html
• Oracle Linux Security Advisory ELSA-2025-0914 vom 2025-02-06
  https://linux.oracle.com/errata/ELSA-2025-0914.html
• Rocky Linux Security Advisory RLSA-2025:0739 vom 2025-02-13
  https://errata.build.resf.org/RLSA-2025:0739
• Deell Security Update
  https://www.dell.com/support/kbdoc/en-us/000281732/dsa-2025-075-security-update-for-dell-data-protection-advisor-for-multiple-component-vulnerabilities
• NetApp Security Advisory NTAP-20231027-0007 vom 2026-05-05
  https://security.netapp.com/advisory/NTAP-20231027-0007