Oracle MySQL: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 33

• Critical 9.8
  CVE-2023-50164 Public exploit EPSS 81%

  Apache Struts: File upload component had a directory traversal vulnerability

  An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. Users are recommended to upgrade to versions Struts 2.5.33 or …

  Apache Software Foundation Apache Struts org.apache.struts:struts2-core Maven
  Dec 7, 2023
• High 8.8
  CVE-2023-38545 Public exploit EPSS 78%

  This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake. When curl is asked to pass along the h…

  curl curl curl curl Debian Ubuntu Azure Linux Alpine Wolfi
  Oct 18, 2023
• High 8.8
  CVE-2023-39975

  kdc/do_tgs_req.c in MIT Kerberos 5 (aka krb5) 1.21 before 1.21.2 has a double free that is reachable if an authenticate…

  Aug 16, 2023
• High 7.5
  CVE-2023-46589

  Apache Tomcat: HTTP request smuggling via malformed trailer headers

  Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82 and from 8.5.0 through 8.5.95 did not correctly parse HTTP trailer headers. A trailer header that e…

  Apache Software Foundation Apache Tomcat tomcat8 tomcat9 Debian Ubuntu Maven
  Nov 28, 2023
• High 7.5
  CVE-2023-5363

  Incorrect cipher key & IV length processing

  Issue summary: A bug has been identified in the processing of key and initialisation vector (IV) lengths. This can lead to potential truncation or overruns during the initialisation of some symmetric ciphers. Impact summary: A truncation in the IV can result …

  OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Oct 24, 2023
• High 7.3
  CVE-2022-46908

  SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the…

  sqlite3 sqlite3 sqlite Debian Ubuntu Azure Linux
  Dec 12, 2022
• Medium 6.5
  CVE-2023-28484

  In libxml2 before 2.10.4, parsing of certain invalid XSD schemas can lead to a NULL pointer dereference and subsequentl…

  libxml2 libxml2 libxml2 libxml2 Debian Ubuntu Azure Linux Alpine
  Apr 24, 2023
• Medium 6.5
  CVE-2024-20960

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: RAPID). Supported versions that are affec…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Feb 17, 2024
• Medium 6.5
  CVE-2024-20961

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux
  Jan 16, 2024
• Medium 6.5
  CVE-2024-20962

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Feb 17, 2024
• Medium 6.5
  CVE-2024-20963

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Encryption). Supported versions…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux
  Jan 16, 2024
• Medium 6.5
  CVE-2024-20973

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux
  Jan 16, 2024
• Medium 6.5
  CVE-2024-20975

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Jan 16, 2024
• Medium 6.5
  CVE-2024-20977

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux
  Jan 16, 2024
• Medium 6.5
  CVE-2024-20985

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: UDF). Supported versions that are affecte…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux
  Jan 16, 2024
• Medium 5.5
  CVE-2024-20967

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux
  Jan 16, 2024
• Medium 5.5
  CVE-2024-20969

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affecte…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux
  Jan 16, 2024
• Medium 5.3
  CVE-2024-20964

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Feb 17, 2024
• Medium 4.9
  CVE-2024-20965

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

  Oracle MySQL Server MySQL NDB Cluster percona-server-5.6 Ubuntu Azure Linux
  Jan 16, 2024
• Medium 4.9
  CVE-2024-20966

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Feb 17, 2024
• Medium 4.9
  CVE-2024-20970

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Feb 17, 2024
• Medium 4.9
  CVE-2024-20971

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux
  Jan 16, 2024
• Medium 4.9
  CVE-2024-20972

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Feb 17, 2024
• Medium 4.9
  CVE-2024-20974

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Feb 17, 2024
• Medium 4.9
  CVE-2024-20976

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Feb 17, 2024
• Medium 4.9
  CVE-2024-20978

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Feb 17, 2024
• Medium 4.9
  CVE-2024-20981

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affecte…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux
  Jan 16, 2024
• Medium 4.9
  CVE-2024-20982

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Feb 17, 2024
• Medium 4.9
  CVE-2024-20983

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affecte…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Jan 16, 2024
• Medium 4.4
  CVE-2024-20968

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Options). Supported versions that are aff…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Feb 17, 2024
• Medium 4.4
  CVE-2024-20984

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server : Security : Firewall). Supported versions…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Feb 17, 2024
• Unscored —
  CVE-2023-2283

  A vulnerability was found in libssh, where the authentication check of the connecting client can be bypassed in the`pki…

  libssh libssh Debian Ubuntu
  May 26, 2023
• Unscored —
  CVE-2023-41105

  An issue was discovered in Python 3.11 through 3.11.4. If a path containing '\0' bytes is passed to os.path.normpath(),…

  python3.11 python3.11 Debian Ubuntu
  Aug 23, 2023

Revision history

1. 2024-11-21 #10

   Neue Updates von XEROX aufgenommen

2. 2024-08-13 #9

   Neue Updates von Fedora aufgenommen

3. 2024-07-15 #8

   Neue Updates von IBM aufgenommen

4. 2024-05-01 #7

   Neue Updates von Red Hat aufgenommen

5. 2024-03-07 #6

   Neue Updates von Oracle Linux aufgenommen

6. 2024-03-05 #5

   Neue Updates von Red Hat aufgenommen

7. 2024-02-21 #4

   Neue Updates von Oracle Linux aufgenommen

8. 2024-02-20 #3

   Neue Updates von Red Hat aufgenommen

9. 2024-01-30 #2

   Neue Updates von Ubuntu aufgenommen

10. 2024-01-16 #1

    Initiale Fassung

References

• Red Hat Security Advisory RHSA-2024:1141 vom 2024-03-06
  https://access.redhat.com/errata/RHSA-2024:1141
• Ubuntu Security Notice USN-6615-1 vom 2024-01-30
  https://ubuntu.com/security/notices/USN-6615-1
• Oracle Critical Patch Update Advisory - January 2024 - Appendix Oracle MySQL vom 2024-01-16
  https://www.oracle.com/security-alerts/cpujan2024.html#AppendixMSQL
• Red Hat Security Advisory RHSA-2024:0894 vom 2024-02-20
  https://access.redhat.com/errata/RHSA-2024:0894
• Oracle Linux Security Advisory ELSA-2024-1141 vom 2024-03-07
  http://linux.oracle.com/errata/ELSA-2024-1141.html
• Atlassian Security Bulletin Februar 2024
  https://confluence.atlassian.com/security/security-bulletin-february-20-2024-1354501606.html
• Oracle Linux Security Advisory ELSA-2024-0894 vom 2024-02-22
  https://linux.oracle.com/errata/ELSA-2024-0894.html
• Red Hat Security Advisory RHSA-2024:2619 vom 2024-04-30
  https://access.redhat.com/errata/RHSA-2024:2619
• IBM Security Bulletin 7160342 vom 2024-07-15
  https://www.ibm.com/support/pages/node/7160342
• Fedora Security Advisory FEDORA-2024-C611359AE1 vom 2024-08-14
  https://bodhi.fedoraproject.org/updates/FEDORA-2024-c611359ae1
• XEROX Security Advisory XRX24-017 vom 2024-11-21
  https://securitydocs.business.xerox.com/wp-content/uploads/2024/11/Xerox-Security-Bulletin-XRX24-017-for-Xerox%C2%AE-FreeFlow%C2%AE-Print-Server-v9.pdf