REDHAT-BUG-2488453: Medium severity MariaDB MariaDB Server vulnerability
MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, mbstream did not check for /../ in the path when unpacking the archive. A proper backup can never contain such paths, but a specially crafted archive could have caused mbstream to create files outside of the target-dir path. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MariaDB mbstreamto a version that resolves this vulnerability.Fixed in 10.6.26 - Upgrade
Upgrade
MariaDB mbstreamto a version that resolves this vulnerability.Fixed in 10.11.17 - Upgrade
Upgrade
MariaDB mbstreamto a version that resolves this vulnerability.Fixed in 11.4.11 - Upgrade
Upgrade
MariaDB mbstreamto a version that resolves this vulnerability.Fixed in 11.8.7 - Upgrade
Upgrade
MariaDB mbstreamto a version that resolves this vulnerability.Fixed in 12.3.2
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2488453?
The severity of REDHAT-BUG-2488453 is medium, rated at 4.
How do I fix REDHAT-BUG-2488453?
To fix REDHAT-BUG-2488453, upgrade MariaDB to versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, or higher.
Which versions of MariaDB are affected by REDHAT-BUG-2488453?
REDHAT-BUG-2488453 affects MariaDB versions from 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1.
What vulnerability does REDHAT-BUG-2488453 describe?
REDHAT-BUG-2488453 describes a path traversal vulnerability in MariaDB's mbstream when unpacking archives.
Is REDHAT-BUG-2488453 a critical vulnerability?
No, REDHAT-BUG-2488453 is considered a medium risk vulnerability.