Skip to content
OpenAdvisories
Medium · 4.9 Public exploit CVE-2023-21887 EUVD-2023-26053GHSA-28xr-rgjv-2mgp

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: GIS). Supported versions that are affected are 8.0.31 and pri…

Published Jan 17, 2023 · Updated Sep 17, 2024 · Assigned by oracle

Vendor: Oracle Product: MySQL Server Package: mysql Package: mysql-5.5 Package: mysql-8.0 Package: percona-server-5.6 Package: percona-xtradb-cluster-5.6 Ecosystem: Azure Linux Ecosystem: Ubuntu

Description

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: GIS). Supported versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

Affected products

VendorProductAffectedFixed
Oracle MySQL Server 8.0.31 and prior —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 22.04 LTS mysql-8.0 8.0.32-0buntu0.22.04.1 USN-5823-1
Ubuntu 20.04 LTS mysql-8.0 8.0.32-0buntu0.20.04.1 USN-5823-1
Ubuntu 18.04 LTS mysql-5.7 5.7.41-0ubuntu0.18.04.1 USN-5823-1
Ubuntu 16.04 LTS percona-server-5.6 +1 No fix yet —
Ubuntu 14.04 LTS mysql-5.5 No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 9 mysql +6 8.0.32-1.el9_2 RHSA-2023:2621
RHEL 8 mecab +1 0.996-2.module+el8.8.0+18436+8918dd75 RHSA-2023:3087
RHEL 8 mecab-ipadic +1 2.7.0.20070801-16.module+el8.0.0+3898+e09bb8de RHSA-2023:3087
RHEL 8 mysql +6 8.0.32-1.module+el8.8.0+18446+fca6280e RHSA-2023:3087
RHEL 3 rh-mysql80-mysql +10 8.0.32-1.el7 RHSA-2023:1102

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 9 mysql +6 8.0.32-1.el9_2 ALSA-2023:2621
AlmaLinux 8 mecab +1 0.996-2.module_el8.6.0+3340+d764b636 ALSA-2023:3087
AlmaLinux 8 mecab-ipadic +1 2.7.0.20070801-16.module_el8.6.0+3340+d764b636 ALSA-2023:3087
AlmaLinux 8 mysql +6 8.0.32-1.module_el8.8.0+3567+56a616e4 ALSA-2023:3087

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 8 mecab 0.996-2.module+el8.10.0+1676+9b4b6e24 RLSA-2023:3087
Rocky Linux 8 mecab-ipadic 2.7.0.20070801-16.module+el8.10.0+1676+9b4b6e24 RLSA-2023:3087

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 2 (CBL-Mariner) mysql 8.0.32-1 —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 9 mysql +6 8.0.32-1.el9_2 ELSA-2023-2621
Oracle Linux 8 mecab +1 0.996-2.module+el8.8.0+21055+76bd398b ELSA-2023-3087
Oracle Linux 8 mecab-ipadic +1 2.7.0.20070801-16.0.1.module+el8.0.0+5253+1dce7bb2 ELSA-2023-3087
Oracle Linux 8 mysql +6 8.0.32-1.module+el8.8.0+21055+76bd398b ELSA-2023-3087

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 10

References