REDHAT-BUG-2359947: Medium severity Oracle MySQL Server vulnerability

Q: What level of access does an attacker need to exploit this issue?

An attacker must be high privileged and have network access to the MySQL Server through multiple protocols. No user interaction is required.

Q: Which deployments should be checked for exposure?

Check Oracle MySQL Server instances running versions 8.0.0 through 8.0.41, 8.4.0 through 8.4.4, or 9.0.0 through 9.2.0. The provided information does not identify any configuration-based exception or mitigation.

Q: What could successful exploitation allow?

Successful exploitation can cause a MySQL Server hang or a frequently repeatable crash resulting in complete denial of service. It can also allow unauthorized updates, inserts, or deletions of some data accessible to MySQL Server.

Published Apr 15, 2025

Updated

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0.0-9.2.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.1 Base Score 5.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H).

Affected Software

1 affected component

Oracle MySQL Server>=8.0.0<=8.0.41, >=8.4.0<=8.4.4, >=9.0.0<=9.2.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade MySQL Server (Oracle MySQL) - InnoDB to a version that resolves this vulnerability.
Fixed in 8.0.0-8.0.41
Upgrade
Upgrade MySQL Server (Oracle MySQL) - InnoDB to a version that resolves this vulnerability.
Fixed in 8.4.0-8.4.4
Upgrade
Upgrade MySQL Server (Oracle MySQL) - InnoDB to a version that resolves this vulnerability.
Fixed in 9.0.0-9.2.0

Event History

Apr 15, 2025

Data Sourced

via Red Hat·09:03 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

An attacker must be high privileged and have network access to the MySQL Server through multiple protocols. No user interaction is required.

Which deployments should be checked for exposure?

Check Oracle MySQL Server instances running versions 8.0.0 through 8.0.41, 8.4.0 through 8.4.4, or 9.0.0 through 9.2.0. The provided information does not identify any configuration-based exception or mitigation.

What could successful exploitation allow?

Successful exploitation can cause a MySQL Server hang or a frequently repeatable crash resulting in complete denial of service. It can also allow unauthorized updates, inserts, or deletions of some data accessible to MySQL Server.

REDHAT-BUG-2359947: Medium severity Oracle MySQL Server vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

Which deployments should be checked for exposure?

What could successful exploitation allow?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

Which deployments should be checked for exposure?

What could successful exploitation allow?