Описание
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0.0-9.2.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.1 Base Score 2.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N).
Отчет
A low-severity vulnerability was found in the InnoDB component of MySQL. A remote attacker who already has high privileges and network access via multiple protocols could exploit this flaw to gain unauthorized update, insert, or delete access to some of the data accessible to MySQL Server. The impact is limited to low integrity impact only, with no impact to confidentiality or availability (CVSS 3.1 base score 2.7, AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N). The mysql components shipped in Red Hat Enterprise Linux 8, 9, and 10 are affected, and fixes are being pursued for those products. The mysql package in Red Hat Enterprise Linux 6 is not affected because the vulnerable code is not present in that version. For Red Hat In-Vehicle OS and Fedora, the fix is deferred; the residual risk is limited because exploitation requires an already highly privileged account and only permits partial modification of data accessible to MySQL Server. Red Hat's severity rating (LOW, 2.7) matches the upstream Oracle assessment, so there is no difference in severity.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | mysql | Not affected | ||
| Red Hat Enterprise Linux 10 | mysql8.4 | Fixed | RHSA-2025:15699 | 11.09.2025 |
| Red Hat Enterprise Linux 10 | mysql-selinux | Fixed | RHSA-2025:15699 | 11.09.2025 |
| Red Hat Enterprise Linux 8 | mysql | Fixed | RHSA-2025:16861 | 29.09.2025 |
| Red Hat Enterprise Linux 9 | mysql | Fixed | RHSA-2025:16046 | 17.09.2025 |
| Red Hat Enterprise Linux 9 | mysql | Fixed | RHSA-2025:16086 | 17.09.2025 |
Показывать по
Дополнительная информация
Статус:
EPSS
2.7 Low
CVSS3
Связанные уязвимости
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0.0-9.2.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.1 Base Score 2.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N).
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0.0-9.2.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.1 Base Score 2.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N).
Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are affected are 5.7.32 and prior and 8.0.22 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Client. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Client. CVSS 3.1 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H).
Vulnerability in the MySQL Server product of Oracle MySQL (component: ...
EPSS
2.7 Low
CVSS3