Описание
MariaDB Server 10.4 through 10.5., 10.6 through 10.6., 10.7 through 10.11., 11.0 through 11.0., and 11.1 through 11.4.* crashes in Item_direct_view_ref::derived_field_transformer_for_where.
A flaw was found in MariaDB Server. This vulnerability may allow an attacker to crash the database via Item_direct_view_ref::derived_field_transformer_for_where.
Отчет
Moderate-impact vulnerability in Red Hat products using affected MariaDB components: a network-reachable attacker with high privileges can trigger Item_direct_view_ref::derived_field_transformer_for_where without user interaction, causing MariaDB Server to crash and resulting in a denial of service. The current record marks MariaDB in multiple Red Hat Enterprise Linux streams and Red Hat In-Vehicle OS as affected, with some streams deferred and others delegated; Community Projects are also delegated as affected. Remediation is deferred for the affected RHEL streams because the issue is moderate severity and exploitation requires high privileges, leaving residual risk of database-service interruption for privileged network attackers. Red Hat Enterprise Linux 7 MariaDB streams are not affected because the vulnerable code is not present.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 7 | mariadb | Not affected | ||
| Red Hat Enterprise Linux 8 | mariadb:10.3/mariadb | Not affected | ||
| Red Hat Enterprise Linux 10 | mariadb10.11 | Fixed | RHSA-2026:0136 | 06.01.2026 |
| Red Hat Enterprise Linux 10.0 Extended Update Support | mariadb10.11 | Fixed | RHSA-2026:0376 | 08.01.2026 |
| Red Hat Enterprise Linux 10.0 Extended Update Support | mariadb10.11 | Fixed | RHSA-2026:49522 | 03.08.2026 |
| Red Hat Enterprise Linux 8 | mariadb | Fixed | RHSA-2025:19572 | 04.11.2025 |
| Red Hat Enterprise Linux 8 | mariadb | Fixed | RHSA-2026:6435 | 02.04.2026 |
| Red Hat Enterprise Linux 9 | galera | Fixed | RHSA-2025:19584 | 04.11.2025 |
| Red Hat Enterprise Linux 9 | mariadb | Fixed | RHSA-2025:19584 | 04.11.2025 |
| Red Hat Enterprise Linux 9 | mariadb | Fixed | RHSA-2026:0247 | 07.01.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
4.9 Medium
CVSS3
Связанные уязвимости
MariaDB Server 10.4 through 10.5.*, 10.6 through 10.6.*, 10.7 through 10.11.*, 11.0 through 11.0.*, and 11.1 through 11.4.* crashes in Item_direct_view_ref::derived_field_transformer_for_where.
MariaDB Server 10.4 through 10.5.*, 10.6 through 10.6.*, 10.7 through 10.11.*, 11.0 through 11.0.*, and 11.1 through 11.4.* crashes in Item_direct_view_ref::derived_field_transformer_for_where.
MariaDB Server 10.4 through 10.5.*, 10.6 through 10.6.*, 10.7 through 10.11.*, 11.0 through 11.0.*, and 11.1 through 11.4.* crashes in Item_direct_view_ref::derived_field_transformer_for_where.
MariaDB Server 10.4 through 10.5.*, 10.6 through 10.6.*, 10.7 through ...
MariaDB Server 10.4 through 10.5.*, 10.6 through 10.6.*, 10.7 through 10.11.*, 11.0 through 11.0.*, and 11.1 through 11.4.* crashes in Item_direct_view_ref::derived_field_transformer_for_where.
EPSS
4.9 Medium
CVSS3