CVE-2024-21160: Medium severity Oracle MySQL vulnerability
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.36 and prior and 8.3.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.0.40-1 - Upgrade
Upgrade
MySQL Server (InnoDB)to a version that resolves this vulnerability.Fixed in 8.0.36 - Upgrade
Upgrade
MySQL Server (InnoDB)to a version that resolves this vulnerability.Fixed in 8.3.0 - Compensating control
Apply a compensating control by restricting network access to the MySQL Server ports so that only trusted hosts can reach the MySQL service endpoints from which the vulnerability could be exploited.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-21160?
CVE-2024-21160 is considered easily exploitable and poses a significant risk to affected MySQL Server installations.
How do I fix CVE-2024-21160?
To mitigate CVE-2024-21160, upgrade MySQL Server to version 8.0.37 or later, or 8.3.1 or later.
Which versions are affected by CVE-2024-21160?
CVE-2024-21160 affects MySQL Server versions 8.0.36 and prior, as well as 8.3.0 and prior.
Who can exploit CVE-2024-21160?
CVE-2024-21160 can be exploited by high-privileged attackers with network access.
What components of MySQL Server does CVE-2024-21160 impact?
CVE-2024-21160 specifically impacts the InnoDB component of MySQL Server.