REDHAT-BUG-2488459: SQL Injection
MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validated user input, escaping it with mysqlrealescapestring() and sending it to the database using text protocol and big5 character set was vulnerable to SQL injections, even though mysqlrealescapestring() was supposed to prevent them. This issue has been patched in versions 3.3.19 and 3.4.9.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MariaDB server (community fork of MySQL)to a version that resolves this vulnerability.Fixed in 3.3.19 - Upgrade
Upgrade
MariaDB server (community fork of MySQL)to a version that resolves this vulnerability.Fixed in 3.4.9
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2488459?
The severity of REDHAT-BUG-2488459 is classified as high with a score of 7.
How do I fix REDHAT-BUG-2488459?
To fix REDHAT-BUG-2488459, upgrade MariaDB to a version that addresses the SQL Injection vulnerability.
What versions of MariaDB are affected by REDHAT-BUG-2488459?
Versions 3.3.18 and 3.4.8 of MariaDB are affected by REDHAT-BUG-2488459.
What type of vulnerability is REDHAT-BUG-2488459?
REDHAT-BUG-2488459 is categorized as an SQL Injection vulnerability.
What is the risk associated with REDHAT-BUG-2488459?
The risk associated with REDHAT-BUG-2488459 is rated at 33.