Описание
Insufficient quoting in mariadb-dump and SHOW commands
Impact
SHOW CREATE SERVER, SHOW CREATE USER commands and mariadb-dump tool did not always quote identifiers and values correctly. An attacker was able to create objects that produced a poisoned dump — when such a dump would be applied, it would execute SQL that the attacker injected into it.
Patches
Fixed in 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, 13.0.2.
Workarounds
Analyze the dump — it usually has a very regular structure, any irregularities would be a sign of injection.
Avoid these mariadb-dump options: --add-drop-trigger, --system, --include-master-host-port.
Or do no apply dumps created by vulnerable mariadb-dump or mariadbd versions.
References
https://jira.mariadb.org/browse/MDEV-39776 https://jira.mariadb.org/browse/MDEV-39818 https://jira.mariadb.org/browse/MDEV-40308 https://jira.mariadb.org/browse/MDEV-40311 https://jira.mariadb.org/browse/MDEV-40312
Credis
Ben Bidner (Automattic.com Security Team)
Пакеты
mariadb
>=10.6.1, <=10.6.27
10.6.28
mariadb
>=10.11.1, <=10.11.18
10.11.19
mariadb
>=11.4.1, <=11.4.12
11.4.13
mariadb
>=11.8.1, <=11.8.8
11.8.9
mariadb
>=12.3.1, <=12.3.2
12.3.3
mariadb
13.0.1
13.0.2