Oracle MySQL: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 33

• Critical 9.1
  CVE-2024-37371

  In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can cause invalid memory reads during GSS message token handlin…

  krb5 krb5 krb5 krb5 Debian Ubuntu Azure Linux Alpine
  Jun 28, 2024
• Critical 9.1
  CVE-2024-5535 Public exploit

  SSL_select_next_proto buffer overread

  Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an empty supported client protocols buffer may cause a crash or memory contents to be sent to the peer. Impact summary: A buffer overread can have a range of potential consequences suc…

  OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Jun 27, 2024
• High 7.5
  CVE-2024-21272

  MySQL Connector/Python connector takeover vulnerability

  Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Python). Supported versions that are affected are 9.0.0 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols…

  Oracle MySQL Connectors airflow mysql-connector-python Ubuntu Wolfi PyPI
  Oct 15, 2024
• Medium 6.5
  CVE-2024-21196

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: X Plugin). Supported versions that are af…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux
  Oct 15, 2024
• Medium 6.5
  CVE-2024-21230

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

  Oracle MySQL Server MySQL Cluster percona-server-5.6 Ubuntu Azure Linux
  Oct 15, 2024
• Medium 6.5
  CVE-2024-21262 Public exploit

  Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/ODBC). Supported versions that are …

  Oracle MySQL Connectors mysql-connector-java Ubuntu
  Oct 15, 2024
• Medium 6.3
  CVE-2024-7264 EPSS 20%

  ASN.1 date parser overread

  libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an ASN.1 Generalized Time field. If given an syntactically incorrect field, the parser might end up using -1 for the length of the *time fraction*, leading to a `strlen()` getting per…

  curl curl curl curl Debian Ubuntu Azure Linux Alpine Wolfi
  Jul 31, 2024
• Medium 5.3
  CVE-2024-21238

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Thread Pooling). Supported versions that …

  Oracle MySQL Server MySQL Cluster mysql-5.5 Ubuntu Azure Linux
  Oct 15, 2024
• Medium 5.3
  CVE-2024-28182 EPSS 82%

  Reading unbounded number of HTTP/2 CONTINUATION frames to cause excessive CPU usage

  nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior to version 1.61.0 keeps reading the unbounded number of HTTP/2 CONTINUATION frames even after a stream is reset to keep HPACK context in sync. This cause…

  nghttp2 nghttp2 rust nodejs Debian Ubuntu Azure Linux Wolfi
  Apr 4, 2024
• Medium 4.9
  CVE-2024-21193

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: PS). Supported versions that are affected…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux
  Oct 15, 2024
• Medium 4.9
  CVE-2024-21194

  Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux
  Oct 15, 2024
• Medium 4.9
  CVE-2024-21197

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema). Supported versions t…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux
  Oct 15, 2024
• Medium 4.9
  CVE-2024-21198

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affecte…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux
  Oct 15, 2024
• Medium 4.9
  CVE-2024-21199

  Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux
  Oct 15, 2024
• Medium 4.9
  CVE-2024-21200

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Oct 15, 2024
• Medium 4.9
  CVE-2024-21201

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux
  Oct 15, 2024
• Medium 4.9
  CVE-2024-21203

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: FTS). Supported versions that are affecte…

  Oracle MySQL Server MySQL Cluster mysql-5.5 Ubuntu Azure Linux
  Oct 15, 2024
• Medium 4.9
  CVE-2024-21204

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: PS). Supported versions that are affected…

  Oracle MySQL Server mysql-5.5 mysql-5.7 Ubuntu
  Oct 15, 2024
• Medium 4.9
  CVE-2024-21207

  Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux
  Oct 15, 2024
• Medium 4.9
  CVE-2024-21218

  Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

  Oracle MySQL Server MySQL Cluster mysql-5.5 Ubuntu Azure Linux
  Oct 15, 2024
• Medium 4.9
  CVE-2024-21219

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affecte…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux
  Oct 15, 2024
• Medium 4.9
  CVE-2024-21236

  Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux
  Oct 15, 2024
• Medium 4.9
  CVE-2024-21239

  Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux
  Oct 15, 2024
• Medium 4.9
  CVE-2024-21241

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux
  Oct 15, 2024
• Medium 4.4
  CVE-2024-21212

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Health Monitor). Supported versions that …

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux
  Oct 15, 2024
• Medium 4.2
  CVE-2024-21213

  Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux
  Oct 15, 2024
• Low 3.8
  CVE-2024-21247

  Vulnerability in the MySQL Client product of Oracle MySQL (component: Client: mysqldump). Supported versions that are a…

  Oracle MySQL Cluster MySQL Client mysql-5.5 Ubuntu Azure Linux
  Oct 15, 2024
• Low 3.1
  CVE-2024-21231

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Client programs). Supported versions that are aff…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux
  Oct 15, 2024
• Low 2.2
  CVE-2024-21232

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Components Services). Supported versions …

  Oracle MySQL Server mysql-5.5 mysql-5.7 Ubuntu
  Oct 15, 2024
• Low 2.2
  CVE-2024-21237

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Group Replication GCS). Supported version…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux
  Oct 15, 2024
• Low 2.2
  CVE-2024-21243

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Telemetry). Supported versions that are a…

  Oracle MySQL Server mysql-5.5 mysql-5.7 Ubuntu
  Oct 15, 2024
• Low 2.2
  CVE-2024-21244

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Telemetry). Supported versions that are a…

  Oracle MySQL Server mysql-5.5 mysql-5.7 Ubuntu
  Oct 15, 2024
• Low 2.0
  CVE-2024-21209

  Vulnerability in the MySQL Client product of Oracle MySQL (component: Client: mysqldump). Supported versions that are a…

  Oracle MySQL Client mysql-5.5 mysql-5.7 Ubuntu
  Oct 15, 2024

Revision history

1. 2026-10-13 #11

   Neue Updates von openSUSE aufgenommen

2. 2026-01-15 #10

   Neue Updates von NetApp aufgenommen

3. 2025-06-10 #9

   Neue Updates von NetApp aufgenommen

4. 2025-05-15 #8

   Neue Updates von IBM aufgenommen

5. 2025-02-26 #7

   Neue Updates von Rocky Enterprise Software Foundation aufgenommen

6. 2025-02-23 #6

   Neue Updates von Oracle Linux aufgenommen

7. 2025-02-18 #5

   Neue Updates von Red Hat aufgenommen

8. 2024-11-12 #4

   Neue Updates von Ubuntu aufgenommen

9. 2024-11-06 #3

   Neue Updates von openSUSE aufgenommen

10. 2024-10-27 #2

    Neue Updates von NetApp aufgenommen

11. 2024-10-15 #1

    Initiale Fassung

References

• Oracle Critical Patch Update Advisory - October 2024 - Appendix Oracle MySQL vom 2024-10-15
  https://www.oracle.com/security-alerts/cpuoct2024.html#AppendixMSQL
• NetApp Security Advisory NTAP-20241025-0006 vom 2024-10-25
  https://security.netapp.com/advisory/ntap-20241025-0006/
• openSUSE Security Update OPENSUSE-SU-2024:0351-1 vom 2024-11-07
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/A4QYWY7IAP4RFAA3R6QMK3Q6FFAY4UOZ/
• Ubuntu Security Notice USN-7102-1 vom 2024-11-12
  https://ubuntu.com/security/notices/USN-7102-1
• Red Hat Security Advisory RHSA-2025:1671 vom 2025-02-19
  https://access.redhat.com/errata/RHSA-2025:1671
• Red Hat Security Advisory RHSA-2025:1673 vom 2025-02-19
  https://access.redhat.com/errata/RHSA-2025:1673
• Oracle Linux Security Advisory ELSA-2025-1673 vom 2025-02-21
  https://linux.oracle.com/errata/ELSA-2025-1673.html
• Oracle Linux Security Advisory ELSA-2025-1671 vom 2025-02-21
  https://linux.oracle.com/errata/ELSA-2025-1671.html
• Rocky Linux Security Advisory RLSA-2025:1673 vom 2025-02-26
  https://errata.build.resf.org/RLSA-2025:1673
• IBM Security Bulletin 7233600 vom 2025-05-15
  https://www.ibm.com/support/pages/node/7233600
• NetApp Security Advisory NTAP-20241101-0006 vom 2025-06-11
  https://security.netapp.com/advisory/NTAP-20241101-0006
• NetApp Security Advisory NTAP-20241101-0009 vom 2025-06-11
  https://security.netapp.com/advisory/NTAP-20241101-0009
• NetApp Security Advisory NTAP-20241101-0007 vom 2025-06-11
  https://security.netapp.com/advisory/NTAP-20241101-0007
• NetApp Security Advisory NTAP-20241101-0005 vom 2025-06-11
  https://security.netapp.com/advisory/NTAP-20241101-0005
• NetApp Security Advisory NTAP-20241025-0009 vom 2025-06-11
  https://security.netapp.com/advisory/NTAP-20241025-0009
• NetApp Security Advisory NTAP-20241025-0008 vom 2025-06-11
  https://security.netapp.com/advisory/NTAP-20241025-0008
• NetApp Security Advisory NTAP-20241025-0007 vom 2025-06-11
  https://security.netapp.com/advisory/NTAP-20241025-0007
• NetApp Security Advisory NTAP-20241101-0008 vom 2026-01-15
  https://security.netapp.com/advisory/NTAP-20241101-0008
• openSUSE Security Update OPENSUSE-SU-2026:12019-1 vom 2026-10-13
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/GX2CH4ZJMVFXIDA7ZIEE7RH4CTXPZ35V/