CVE-2021-46664: Null Pointer Dereference
MariaDB through 10.5.9 allows an application crash in subselectpostjoinaggr for a NULL value of aggr.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2021-46664?
The severity of CVE-2021-46664 is classified as a medium risk due to its potential to cause application crashes.
How do I fix CVE-2021-46664?
To fix CVE-2021-46664, upgrade to MariaDB versions 10.2.43, 10.3.34, 10.4.24, 10.5.15, 10.6.7, 10.7.3, or newer.
Which versions of MariaDB are affected by CVE-2021-46664?
CVE-2021-46664 affects MariaDB versions prior to 10.5.10 and includes versions 10.2.x up to 10.2.43, 10.3.x up to 10.3.34, 10.4.x up to 10.4.24, and 10.5.x up to 10.5.9.
What exploit does CVE-2021-46664 represent?
CVE-2021-46664 represents an application crash exploit that occurs in the sub_select_postjoin_aggr function when a NULL value of aggr is encountered.
Is there a workaround for CVE-2021-46664?
A viable workaround for CVE-2021-46664 is to avoid sending NULL values in the aggregate function aggr for affected MariaDB versions.