REDHAT-BUG-2505182: Low severity Oracle MySQL Server vulnerability
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Pluggable Auth). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server, MySQL Cluster accessible data. CVSS 3.1 Base Score 2.9 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Oracle MySQL (MySQL Server, MySQL Cluster) - Server: Pluggable Authto a version that resolves this vulnerability.Fixed in 8.4.0-8.4.10 - Upgrade
Upgrade
Oracle MySQL (MySQL Server, MySQL Cluster) - Server: Pluggable Authto a version that resolves this vulnerability.Fixed in 9.7.0-9.7.1 - Upgrade
Upgrade
Oracle MySQL (MySQL Server, MySQL Cluster) - Server: Pluggable Authto a version that resolves this vulnerability.Fixed in 8.0.0-8.0.47
Event History
Frequently Asked Questions
Who can realistically exploit this issue?
An attacker must be able to log on to the infrastructure hosting MySQL Server or MySQL Cluster. The CVSS vector identifies the attack as local, with no MySQL privileges or user interaction required, but exploitation is considered difficult.
What is the potential impact if exploitation succeeds?
A successful attack can provide unauthorized update, insert, or delete access to some data accessible to the affected MySQL Server or MySQL Cluster instance. The stated impact is limited to integrity; no confidentiality or availability impact is specified.
Which releases are identified as affected?
Affected MySQL Server releases are 8.4.0 through 8.4.10 and 9.7.0 through 9.7.1. Affected MySQL Cluster releases are 8.0.0 through 8.0.47, 8.4.0 through 8.4.10, and 9.7.0 through 9.7.1.