Описание
MariaDB server is a community developed fork of MySQL server. From versions 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, a user getting EXECUTE access to a stored routine via a role, could see the routine definition even without SHOW CREATE ROUTINE privilege. This issue has been patched in versions 11.4.11, 11.8.7, and 12.3.2.
A flaw was found in MariaDB server. A user who has been granted EXECUTE access to a stored routine through a role can view the definition of that routine. This information disclosure occurs even if the user does not possess the SHOW CREATE ROUTINE privilege, potentially exposing sensitive routine logic. This vulnerability allows for unauthorized access to routine definitions.
Отчет
Moderate: MariaDB server, as shipped in Red Hat products, is affected by an information disclosure flaw. A user granted EXECUTE access to a stored routine through a role can view the routine's definition without possessing the SHOW CREATE ROUTINE privilege. This is considered Moderate as it requires existing privileges and only exposes routine logic, not arbitrary code execution or data manipulation.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | mariadb10.11 | Not affected | ||
| Red Hat Enterprise Linux 7 | mariadb | Not affected | ||
| Red Hat Enterprise Linux 8 | mariadb:10.11/mariadb | Not affected | ||
| Red Hat Enterprise Linux 8 | mariadb:10.3/mariadb | Not affected | ||
| Red Hat Enterprise Linux 9 | mariadb | Not affected | ||
| Red Hat Enterprise Linux 9 | mariadb:10.11/mariadb | Not affected | ||
| Red Hat Enterprise Linux 10 | mariadb11.8 | Fixed | RHSA-2026:33412 | 30.06.2026 |
| Red Hat Enterprise Linux 9 | mariadb | Fixed | RHSA-2026:33481 | 30.06.2026 |
| Red Hat Hardened Images | mariadb11-8-main-11.8.8-1.hum1 | Fixed | RHSA-2026:25143 | 10.06.2026 |
| Red Hat Hardened Images | mariadb10-11-main-10.11.18-1.hum1 | Fixed | RHSA-2026:25145 | 10.06.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
4.3 Medium
CVSS3
Связанные уязвимости
MariaDB server is a community developed fork of MySQL server. From versions 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, a user getting EXECUTE access to a stored routine via a role, could see the routine definition even without SHOW CREATE ROUTINE privilege. This issue has been patched in versions 11.4.11, 11.8.7, and 12.3.2.
MariaDB server is a community developed fork of MySQL server. From versions 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, a user getting EXECUTE access to a stored routine via a role, could see the routine definition even without SHOW CREATE ROUTINE privilege. This issue has been patched in versions 11.4.11, 11.8.7, and 12.3.2.
MariaDB server is a community developed fork of MySQL server. From ver ...
Authorization bypass in role-based routine-level privilege check exposes stored routine definitions
EPSS
4.3 Medium
CVSS3