High WID-SEC-2024-1656 33 CVEs

Oracle MySQL: Mehrere Schwachstellen

Published Jul 16, 2024 · Updated Jun 10, 2025 · Revision 8 · de-DE

Vendor: F5 Vendor: Fedora Vendor: IBM Vendor: NETAPP Vendor: Oracle Vendor: Ubuntu Vendor: Xerox Product: ActiveIQ Unified Manager Product: BIG-IP Product: FreeFlow Print Server Product: Linux Product: Linux Product: MySQL Product: Security Guardium Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle MySQL ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.

Product

MySQL ist ein Open Source Datenbankserver von Oracle.

Vulnerabilities 33

High 8.2

CVE-2024-22257

Erroneous authentication pass in Spring Security

In Spring Security, versions 5.7.x prior to 5.7.12, 5.8.x prior to 5.8.11, versions 6.0.x prior to 6.0.9, versions 6.1.x prior to 6.1.8, versions 6.2.x prior to 6.2.3, an application is possible vulnerable to broken access control when it directly uses the Au…

org.springframework.security:spring-security-core Maven

Mar 18, 2024
High 8.1

CVE-2021-24112

.NET Core Remote Code Execution Vulnerability

.NET Core Remote Code Execution Vulnerability

Microsoft .NET Core 3.1 .NET 5.0 .NET Core 2.1 NuGet

Feb 25, 2021
High 8.1

CVE-2024-22262 Public exploit

CVE-2024-22262: Spring Framework URL Parsing with Host Validation

Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html a…

Spring Spring Framework libspring-java libspring-java Debian Ubuntu Maven

Apr 16, 2024
High 7.5

CVE-2023-37920

Certifi's removal of e-Tugra root certificate

Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi prior to version 2023.07.22 recognizes "e-Tugra" root certificates. e-Tugra's root certificates were…

certifi python-certifi python-pip certifi Debian Ubuntu Azure Linux Alpine Wolfi PyPI

Jul 25, 2023
High 7.5

CVE-2023-52425

libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in t…

insighttoolkit4 expat vtk swish-e Debian Ubuntu Azure Linux Alpine

Feb 4, 2024
High 7.5

CVE-2024-24549 Public exploit EPSS 23%

Apache Tomcat: HTTP/2 header handling DoS

Denial of Service due to improper input validation vulnerability for HTTP/2 requests in Apache Tomcat. When processing an HTTP/2 request, if the request exceeded any of the configured limits for headers, the associated HTTP/2 stream was not reset until after …

Apache Software Foundation Apache Tomcat tomcat8 tomcat9 Debian Ubuntu Maven

Mar 13, 2024
High 7.5

CVE-2024-25062

An issue was discovered in libxml2 before 2.11.7 and 2.12.x before 2.12.5. When using the XML Reader interface with DTD…

qt6-qtwebengine libxml2 libxml2 libxml2 Debian Ubuntu Azure Linux Alpine Wolfi

Feb 4, 2024
Medium 6.5

CVE-2023-6129

POLY1305 MAC implementation corrupts vector registers on PowerPC

Issue summary: The POLY1305 MAC (message authentication code) implementation contains a bug that might corrupt the internal state of applications running on PowerPC CPU based platforms if the CPU provides vector instructions. Impact summary: If an attacker ca…

OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi

Jan 9, 2024
Medium 6.5

CVE-2024-21171

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux

Jul 16, 2024
Medium 6.5

CVE-2024-21177

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

Oracle MySQL Server MySQL NDB Cluster percona-server-5.6 Ubuntu

Jul 16, 2024
Medium 6.3

CVE-2024-21170

Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Python). Supported versions that ar…

Oracle MySQL Connectors mysql-connector-python Ubuntu

Jul 16, 2024
Medium 6.2

CVE-2024-0450

Quoted zip-bomb protection for zipfile

An issue was found in the CPython `zipfile` module affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior. The zipfile module is vulnerable to “quoted-overlap” zip-bombs which exploit the zip format to create a zip-bomb with a high compressi…

Python Software Foundation CPython python3.4 python3.5 Debian Ubuntu Azure Linux Alpine Wolfi

Mar 19, 2024
Medium 5.9

CVE-2023-48795 Public exploit Scanner template EPSS 94%

Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server…

zot kubescape kots rust Debian Ubuntu Azure Linux Alpine Wolfi PyPI Go crates.io

Dec 18, 2023
Medium 5.9

CVE-2024-21166

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux

Jul 16, 2024
Medium 5.5

CVE-2024-21163

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux

Jul 16, 2024
Medium 5.3

CVE-2024-21176

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Thread Pooling). Supported versions that …

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu

Jul 16, 2024
Medium 4.9

CVE-2024-20996

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux

Jul 16, 2024
Medium 4.9

CVE-2024-21125

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: FTS). Supported versions that are affecte…

Oracle MySQL Server MySQL NDB Cluster percona-server-5.6 Ubuntu Azure Linux

Jul 16, 2024
Medium 4.9

CVE-2024-21127

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affecte…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux

Jul 16, 2024
Medium 4.9

CVE-2024-21129

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affecte…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux

Jul 16, 2024
Medium 4.9

CVE-2024-21130

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux

Jul 16, 2024
Medium 4.9

CVE-2024-21135

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux

Jul 16, 2024
Medium 4.9

CVE-2024-21137

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu

Jul 16, 2024
Medium 4.9

CVE-2024-21142

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux

Jul 16, 2024
Medium 4.9

CVE-2024-21157

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux

Jul 16, 2024
Medium 4.9

CVE-2024-21159

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux

Jul 16, 2024
Medium 4.9

CVE-2024-21160

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux

Jul 16, 2024
Medium 4.9

CVE-2024-21162

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux

Jul 16, 2024
Medium 4.9

CVE-2024-21165

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Pluggable Auth). Supported versions that …

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux

Jul 16, 2024
Medium 4.9

CVE-2024-21173

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux

Jul 16, 2024
Medium 4.9

CVE-2024-21179

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu

Jul 16, 2024
Medium 4.9

CVE-2024-21185

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu

Jul 16, 2024
Medium 4.3

CVE-2024-21134

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Connection Handling). Supported versions …

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux

Jul 16, 2024

Revision history

2025-06-10 #8
Neue Updates von NetApp aufgenommen
2025-01-12 #7
Neue Updates von XEROX aufgenommen
2025-01-07 #6
Neue Updates von IBM aufgenommen
2024-10-23 #5
Neue Updates von IBM aufgenommen
2024-09-03 #4
Neue Updates von F5 aufgenommen
2024-08-11 #3
Neue Updates von Fedora aufgenommen
2024-07-31 #2
Neue Updates von Ubuntu aufgenommen
2024-07-16 #1
Initiale Fassung

References

Oracle Critical Patch Update Advisory - July 2024 - Appendix Oracle MySQL vom 2024-07-16
https://www.oracle.com/security-alerts/cpujul2024.html#AppendixMSQL
Ubuntu Security Notice USN-6934-1 vom 2024-07-31
https://ubuntu.com/security/notices/USN-6934-1
Fedora Security Advisory FEDORA-2024-5D9DC19F2D vom 2024-08-12
https://bodhi.fedoraproject.org/updates/FEDORA-2024-5d9dc19f2d
F5 Security Advisory K000140908 vom 2024-09-03
https://my.f5.com/manage/s/article/K000140908
IBM Security Bulletin 7173959 vom 2024-10-23
https://www.ibm.com/support/pages/node/7173959
IBM Security Bulletin 7180384 vom 2025-01-07
https://www.ibm.com/support/pages/node/7180384
XEROX Security Advisory XRX25-001 vom 2025-01-13
https://securitydocs.business.xerox.com/wp-content/uploads/2025/01/Xerox-Security-Bulletin-XRX25-001-for-Xerox%C2%AE-FreeFlow%C2%AE-Print-Server-v9.pdf
NetApp Security Advisory NTAP-20240801-0001 vom 2025-06-11
https://security.netapp.com/advisory/NTAP-20240801-0001
NetApp Security Advisory NTAP-20240731-0007 vom 2025-06-11
https://security.netapp.com/advisory/NTAP-20240731-0007
NetApp Security Advisory NTAP-20240731-0006 vom 2025-06-11
https://security.netapp.com/advisory/NTAP-20240731-0006