REDHAT-BUG-2505319: Medium severity Oracle MySQL Server vulnerability
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.1 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Oracle MySQL (MySQL Server / MySQL Cluster) - Server: Replicationto a version that resolves this vulnerability.Fixed in 8.4.0-8.4.10 - Upgrade
Upgrade
Oracle MySQL (MySQL Server / MySQL Cluster) - Server: Replicationto a version that resolves this vulnerability.Fixed in 9.7.0-9.7.1 - Upgrade
Upgrade
Oracle MySQL (MySQL Server / MySQL Cluster) - Server: Replicationto a version that resolves this vulnerability.Fixed in 8.0.0-8.0.47
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Systems running the affected MySQL Server or MySQL Cluster versions are exposed only to an attacker who already has high privileges and local logon access to the infrastructure where the service executes. The issue is not described as remotely exploitable or requiring user interaction.
What impact could successful exploitation have?
A successful attack can cause MySQL Server or MySQL Cluster to hang or crash repeatedly, resulting in a complete denial of service. No confidentiality or integrity impact is identified in the provided CVSS vector.
Which versions are affected?
Affected MySQL Server versions are 8.4.0 through 8.4.10 and 9.7.0 through 9.7.1. Affected MySQL Cluster versions are 8.0.0 through 8.0.47, 8.4.0 through 8.4.10, and 9.7.0 through 9.7.1.
What should be prioritized if patching cannot happen immediately?
Restrict high-privilege local access to the infrastructure hosting MySQL Server or MySQL Cluster, since exploitation requires both local access and high privileges. Monitor affected services for unexplained hangs or recurring crashes, as these are the stated attack outcome.