Описание
A remote code execution issue was discovered in MariaDB 10.2 before 10.2.37, 10.3 before 10.3.28, 10.4 before 10.4.18, and 10.5 before 10.5.9; Percona Server through 2021-03-03; and the wsrep patch through 2021-03-03 for MySQL. An untrusted search path leads to eval injection, in which a database SUPER user can execute OS commands after modifying wsrep_provider and wsrep_notify_cmd. NOTE: this does not affect an Oracle product.
Меры по смягчению последствий
Only users that have the SUPER privilege can exploit this flaw. To reduce your exposure, ensure user accounts with the SUPER privilege are protected with strong credentials, only allowed to connect locally and not shared with untrusted parties.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | mysql | Not affected | ||
| Red Hat Enterprise Linux 7 | mariadb | Not affected | ||
| Red Hat Enterprise Linux 8 | mariadb:10.5/mariadb | Not affected | ||
| Red Hat Enterprise Linux 8 | mysql:8.0/mysql | Not affected | ||
| Red Hat Enterprise Linux 9 | mariadb | Not affected | ||
| Red Hat Enterprise Linux 9 | mysql | Not affected | ||
| Red Hat Software Collections | rh-mariadb105-mariadb | Not affected | ||
| Red Hat Enterprise Linux 8 | mariadb | Fixed | RHSA-2021:1242 | 19.04.2021 |
| Red Hat Enterprise Linux 8 | mariadb-devel | Fixed | RHSA-2021:1242 | 19.04.2021 |
| Red Hat Enterprise Linux 8.1 Extended Update Support | mariadb | Fixed | RHSA-2021:1241 | 19.04.2021 |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
7.2 High
CVSS3
Связанные уязвимости
A remote code execution issue was discovered in MariaDB 10.2 before 10.2.37, 10.3 before 10.3.28, 10.4 before 10.4.18, and 10.5 before 10.5.9; Percona Server through 2021-03-03; and the wsrep patch through 2021-03-03 for MySQL. An untrusted search path leads to eval injection, in which a database SUPER user can execute OS commands after modifying wsrep_provider and wsrep_notify_cmd. NOTE: this does not affect an Oracle product.
A remote code execution issue was discovered in MariaDB 10.2 before 10.2.37, 10.3 before 10.3.28, 10.4 before 10.4.18, and 10.5 before 10.5.9; Percona Server through 2021-03-03; and the wsrep patch through 2021-03-03 for MySQL. An untrusted search path leads to eval injection, in which a database SUPER user can execute OS commands after modifying wsrep_provider and wsrep_notify_cmd. NOTE: this does not affect an Oracle product.
A remote code execution issue was discovered in MariaDB 10.2 before 10 ...
7.2 High
CVSS3