RLSA-2025:1671

Опубликовано: 17 мар. 2025

Источник: rocky

Оценка: Important

Описание

Important: mysql security update

MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon (mysqld) and many client programs and libraries.

Security Fix(es):

openssl: SSL_select_next_proto buffer overread (CVE-2024-5535)
krb5: GSS message token handling (CVE-2024-37371)
curl: libcurl: ASN.1 date parser overread (CVE-2024-7264)
mysql: Thread Pooling unspecified vulnerability (CPU Oct 2024) (CVE-2024-21238)
mysql: X Plugin unspecified vulnerability (CPU Oct 2024) (CVE-2024-21196)
mysql: Optimizer unspecified vulnerability (CPU Oct 2024) (CVE-2024-21241)
mysql: Client programs unspecified vulnerability (CPU Oct 2024) (CVE-2024-21231)
mysql: Information Schema unspecified vulnerability (CPU Oct 2024) (CVE-2024-21197)
mysql: InnoDB unspecified vulnerability (CPU Oct 2024) (CVE-2024-21218)
mysql: Optimizer unspecified vulnerability (CPU Oct 2024) (CVE-2024-21201)
mysql: InnoDB unspecified vulnerability (CPU Oct 2024) (CVE-2024-21236)
mysql: Group Replication GCS unspecified vulnerability (CPU Oct 2024) (CVE-2024-21237)
mysql: FTS unspecified vulnerability (CPU Oct 2024) (CVE-2024-21203)
mysql: Health Monitor unspecified vulnerability (CPU Oct 2024) (CVE-2024-21212)
mysql: DML unspecified vulnerability (CPU Oct 2024) (CVE-2024-21219)
mysql: Optimizer unspecified vulnerability (CPU Oct 2024) (CVE-2024-21230)
mysql: InnoDB unspecified vulnerability (CPU Oct 2024) (CVE-2024-21213)
mysql: InnoDB unspecified vulnerability (CPU Oct 2024) (CVE-2024-21194)
mysql: InnoDB unspecified vulnerability (CPU Oct 2024) (CVE-2024-21199)
mysql: PS unspecified vulnerability (CPU Oct 2024) (CVE-2024-21193)
mysql: DDL unspecified vulnerability (CPU Oct 2024) (CVE-2024-21198)
mysql: mysqldump unspecified vulnerability (CPU Oct 2024) (CVE-2024-21247)
mysql: InnoDB unspecified vulnerability (CPU Oct 2024) (CVE-2024-21239)
curl: curl netrc password leak (CVE-2024-11053)
mysql: InnoDB unspecified vulnerability (CPU Jan 2025) (CVE-2025-21497)
mysql: MySQL Server Options Vulnerability (CVE-2025-21520)
mysql: High Privilege Denial of Service Vulnerability in MySQL Server (CVE-2025-21490)
mysql: Information Schema unspecified vulnerability (CPU Jan 2025) (CVE-2025-21529)
mysql: InnoDB unspecified vulnerability (CPU Jan 2025) (CVE-2025-21531)
mysql: Optimizer unspecified vulnerability (CPU Jan 2025) (CVE-2025-21504)
mysql: Privileges unspecified vulnerability (CPU Jan 2025) (CVE-2025-21540)
mysql: MySQL Server InnoDB Denial of Service and Unauthorized Data Modification Vulnerability (CVE-2025-21555)
mysql: Packaging unspecified vulnerability (CPU Jan 2025) (CVE-2025-21543)
mysql: MySQL Server InnoDB Denial of Service and Unauthorized Data Modification Vulnerability (CVE-2025-21491)
mysql: DDL unspecified vulnerability (CPU Jan 2025) (CVE-2025-21525)
mysql: Optimizer unspecified vulnerability (CPU Jan 2025) (CVE-2025-21536)
mysql: Thread Pooling unspecified vulnerability (CPU Jan 2025) (CVE-2025-21521)
mysql: Optimizer unspecified vulnerability (CPU Jan 2025) (CVE-2025-21501)
mysql: Performance Schema unspecified vulnerability (CPU Jan 2025) (CVE-2025-21534)
mysql: Privileges unspecified vulnerability (CPU Jan 2025) (CVE-2025-21494)
mysql: Privileges unspecified vulnerability (CPU Jan 2025) (CVE-2025-21519)
mysql: Parser unspecified vulnerability (CPU Jan 2025) (CVE-2025-21522)
mysql: InnoDB unspecified vulnerability (CPU Jan 2025) (CVE-2025-21503)
mysql: Optimizer unspecified vulnerability (CPU Jan 2025) (CVE-2025-21518)
mysql: MySQL Server InnoDB Denial of Service and Unauthorized Data Modification Vulnerability (CVE-2025-21559)
mysql: Privilege Misuse in MySQL Server Security Component (CVE-2025-21546)
mysql: Optimizer unspecified vulnerability (CPU Jan 2025) (CVE-2025-21500)
mysql: InnoDB unspecified vulnerability (CPU Jan 2025) (CVE-2025-21523)
mysql: Components Services unspecified vulnerability (CPU Jan 2025) (CVE-2025-21505)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Затронутые продукты

Rocky Linux 9

Наименование	Архитектура	Релиз	RPM
mysql	x86_64	2.el9_5	mysql-8.0.41-2.el9_5.x86_64.rpm
mysql-common	x86_64	2.el9_5	mysql-common-8.0.41-2.el9_5.x86_64.rpm
mysql-errmsg	x86_64	2.el9_5	mysql-errmsg-8.0.41-2.el9_5.x86_64.rpm
mysql-server	x86_64	2.el9_5	mysql-server-8.0.41-2.el9_5.x86_64.rpm

Показывать по

Ссылки на источники

Исправления

https://bugzilla.redhat.com/show_bug.cgi?id=2294581
Red Hat - 2294581
https://bugzilla.redhat.com/show_bug.cgi?id=2294676
Red Hat - 2294676
https://bugzilla.redhat.com/show_bug.cgi?id=2301888
Red Hat - 2301888
https://bugzilla.redhat.com/show_bug.cgi?id=2318857
Red Hat - 2318857
https://bugzilla.redhat.com/show_bug.cgi?id=2318858
Red Hat - 2318858
https://bugzilla.redhat.com/show_bug.cgi?id=2318870
Red Hat - 2318870
https://bugzilla.redhat.com/show_bug.cgi?id=2318873
Red Hat - 2318873
https://bugzilla.redhat.com/show_bug.cgi?id=2318874
Red Hat - 2318874
https://bugzilla.redhat.com/show_bug.cgi?id=2318876
Red Hat - 2318876
https://bugzilla.redhat.com/show_bug.cgi?id=2318882
Red Hat - 2318882
https://bugzilla.redhat.com/show_bug.cgi?id=2318883
Red Hat - 2318883
https://bugzilla.redhat.com/show_bug.cgi?id=2318884
Red Hat - 2318884
https://bugzilla.redhat.com/show_bug.cgi?id=2318885
Red Hat - 2318885
https://bugzilla.redhat.com/show_bug.cgi?id=2318886
Red Hat - 2318886
https://bugzilla.redhat.com/show_bug.cgi?id=2318897
Red Hat - 2318897
https://bugzilla.redhat.com/show_bug.cgi?id=2318900
Red Hat - 2318900
https://bugzilla.redhat.com/show_bug.cgi?id=2318905
Red Hat - 2318905
https://bugzilla.redhat.com/show_bug.cgi?id=2318914
Red Hat - 2318914
https://bugzilla.redhat.com/show_bug.cgi?id=2318922
Red Hat - 2318922
https://bugzilla.redhat.com/show_bug.cgi?id=2318923
Red Hat - 2318923

Связанные уязвимости

RLSA-2025:1673

rocky

11 месяцев назад

Important: mysql:8.0 security update

ELSA-2025-1673

oracle-oval

12 месяцев назад

ELSA-2025-1673: mysql:8.0 security update (IMPORTANT)

ELSA-2025-1671

oracle-oval

12 месяцев назад

ELSA-2025-1671: mysql security update (IMPORTANT)

CVE-2024-11053

CVSS3: 3.4

ubuntu

около 1 года назад

When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has an entry that matches the redirect target hostname but the entry either omits just the password or omits both login and password.

CVE-2024-11053

CVSS3: 5.9

redhat