Описание
Security update for mariadb
This update for mariadb fixes the following issues:
Security fixes:
- CVE-2026-3494: audit plugin comment handling bypass (bsc#1259176).
- CVE-2026-44168: wsrep SST unsafe parameter handling on the donor side (bsc#1266442).
- CVE-2026-44170: argument injection in CONNECT REST Xcurl on Windows via unsanitized URL (bsc#1266440).
- CVE-2026-44171: path traversal in mbstream (bsc#1266439).
- CVE-2026-44172: mysql_real_escape_string() incorrectly handled big5 (bsc#1266438).
- CVE-2026-44173: FILE privilege was not checked for subqueries in the FROM clause (bsc#1266437).
- CVE-2026-48163: wsrep SST unsafe parameter handling on the donor side (bsc#1266815).
- CVE-2026-48165: unsafe usage of
wsrep_sst_receive_addressvalues on the joiner side (bsc#1266814). - CVE-2026-49261: unsafe parameter handling in
wsrep_notify_cmd(bsc#1267542).
Other fixes:
- Update to 10.6.27: https://mariadb.com/docs/release-notes/community-server/10.6/10.6.27 https://mariadb.com/docs/release-notes/community-server/changelogs/10.6/10.6.27
- Update to 10.6.26: https://mariadb.com/docs/release-notes/community-server/10.6/10.6.26 https://mariadb.com/docs/release-notes/community-server/changelogs/10.6/10.6.26 https://mariadb.com/docs/release-notes/community-server/10.6/10.6.25 https://mariadb.com/docs/release-notes/community-server/changelogs/10.6/10.6.25
Список пакетов
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS
SUSE Linux Enterprise Server 15 SP4-LTSS
SUSE Linux Enterprise Server 15 SP5-LTSS
SUSE Linux Enterprise Server for SAP Applications 15 SP4
SUSE Linux Enterprise Server for SAP Applications 15 SP5
Ссылки
- Link for SUSE-SU-2026:2282-1
- E-Mail link for SUSE-SU-2026:2282-1
- SUSE Security Ratings
- SUSE Bug 1259176
- SUSE Bug 1266437
- SUSE Bug 1266438
- SUSE Bug 1266439
- SUSE Bug 1266440
- SUSE Bug 1266442
- SUSE Bug 1266814
- SUSE Bug 1266815
- SUSE Bug 1267542
- SUSE CVE CVE-2026-3494 page
- SUSE CVE CVE-2026-44168 page
- SUSE CVE CVE-2026-44170 page
- SUSE CVE CVE-2026-44171 page
- SUSE CVE CVE-2026-44172 page
- SUSE CVE CVE-2026-44173 page
- SUSE CVE CVE-2026-48163 page
- SUSE CVE CVE-2026-48165 page
Описание
In MariaDB server version through 11.8.5, when server audit plugin is enabled with server_audit_events variable configured with QUERY_DCL, QUERY_DDL, or QUERY_DML filtering, if an authenticated database user invokes a SQL statement prefixed with double-hyphen (-) or hash (#) style comments, the statement is not logged.
Затронутые продукты
Ссылки
- CVE-2026-3494
- SUSE Bug 1259176
Описание
MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shell commands on the donor side via the mariabackup SST method. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.
Затронутые продукты
Ссылки
- CVE-2026-44168
- SUSE Bug 1266442
Описание
MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, MariaDB on WIndows with installed CONNECT engine and enabled REST support interpolated table HTTP attribute into the curl command line without proper sanitizing. This allows the user to execute shell commands on the server. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.
Затронутые продукты
Ссылки
- CVE-2026-44170
- SUSE Bug 1266440
Описание
MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, mbstream did not check for /../ in the path when unpacking the archive. A proper backup can never contain such paths, but a specially crafted archive could have caused mbstream to create files outside of the target-dir path. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.
Затронутые продукты
Ссылки
- CVE-2026-44171
- SUSE Bug 1266439
Описание
MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validated user input, escaping it with mysql_real_escape_string() and sending it to the database using text protocol and big5 character set was vulnerable to SQL injections, even though mysql_real_escape_string() was supposed to prevent them. This issue has been patched in versions 3.3.19 and 3.4.9.
Затронутые продукты
Ссылки
- CVE-2026-44172
- SUSE Bug 1266438
Описание
MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, MariaDB allowed SELECT ... INTO OUTFILE and SELECT ... INTO DUMPFILE without verifying the FILE privilege if the FROM clause contained only subqueries. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.
Затронутые продукты
Ссылки
- CVE-2026-44173
- SUSE Bug 1266437
Описание
MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shell commands on the donor side via the rsync SST method. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2.
Затронутые продукты
Ссылки
- CVE-2026-48163
- SUSE Bug 1266815
Описание
MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, a high-privileged MariaDB user could've used wsrep_sst_receive_address or wsrep_sst_donor global system variables to execute shell commands as the uid of the mariadbd process on the galera joiner node. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2.
Затронутые продукты
Ссылки
- CVE-2026-48165
- SUSE Bug 1266814
Описание
MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1 with `wsrep_notify_cmd` enabled would execute shell commands embedded in the name of the joiner node. This is fixed in 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2. As a workaround, anyone who cannot upgrade now should disable `wsrep_notify_cmd`.
Затронутые продукты
Ссылки
- CVE-2026-49261
- SUSE Bug 1267542