CVE-2024-21247

Description

Vulnerability in the MySQL Client product of Oracle MySQL (component: Client: mysqldump). Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and 9.0.1 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Client. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Client accessible data as well as unauthorized read access to a subset of MySQL Client accessible data. CVSS 3.1 Base Score 3.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N).

Affected products

Vendor	Product	Affected	Fixed
Oracle	MySQL Cluster	≤ 7.5.35, ≤ 7.6.31, ≤ 8.0.39, ≤ 8.4.2, ≤ 9.0.1	—
Oracle	MySQL Client	≤ 8.0.39, ≤ 8.4.2, ≤ 9.0.1	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 14.04 LTS	mysql-5.5	No fix yet	—

Show 1 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Ubuntu Pro 16.04 LTS	mysql-5.7	No fix yet	—

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
RHEL 9	mysql +6	8.0.41-2.el9_5	RHSA-2025:1671
RHEL 8	mecab +1	0.996-2.module+el8.10.0+22857+7f331edd	RHSA-2025:1673
RHEL 8	mecab-ipadic +1	2.7.0.20070801-17.module+el8.10.0+22857+7f331edd	RHSA-2025:1673
RHEL 8	mysql +6	8.0.41-1.module+el8.10.0+22857+7f331edd	RHSA-2025:1673

AlmaLinux

Errata ↗

Release	Package	Fixed in	Advisory
AlmaLinux 9	mysql +6	8.0.41-2.el9_5	ALSA-2025:1671
AlmaLinux 8	mecab +1	0.996-2.module_el8.6.0+3340+d764b636	ALSA-2025:1673
AlmaLinux 8	mecab-ipadic +1	2.7.0.20070801-17.module_el8.10.0+3965+b415b607	ALSA-2025:1673
AlmaLinux 8	mysql +6	8.0.41-1.module_el8.10.0+3965+b415b607	ALSA-2025:1673

Rocky Linux