REDHAT-BUG-2505594: Medium severity Oracle MySQL Server vulnerability
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Oracle MySQL (Server: Clone Plugin)to a version that resolves this vulnerability.Fixed in 8.4.0-8.4.10 - Upgrade
Upgrade
Oracle MySQL (Server: Clone Plugin)to a version that resolves this vulnerability.Fixed in 9.7.0-9.7.1 - Upgrade
Upgrade
Oracle MySQL Cluster (Server: Clone Plugin)to a version that resolves this vulnerability.Fixed in 8.0.0-8.0.47 - Upgrade
Upgrade
Oracle MySQL Cluster (Server: Clone Plugin)to a version that resolves this vulnerability.Fixed in 8.4.0-8.4.10 - Upgrade
Upgrade
Oracle MySQL Cluster (Server: Clone Plugin)to a version that resolves this vulnerability.Fixed in 9.7.0-9.7.1
Event History
Frequently Asked Questions
Who can exploit this issue?
Exploitation requires a high-privileged attacker with network access to the affected MySQL Server or MySQL Cluster instance. The vulnerability is rated difficult to exploit and does not require user interaction.
Which deployments are affected?
Affected supported releases are MySQL Server 8.4.0 through 8.4.10 and 9.7.0 through 9.7.1; and MySQL Cluster 8.0.0 through 8.0.47, 8.4.0 through 8.4.10, and 9.7.0 through 9.7.1.
What is the potential impact of successful exploitation?
A successful attack can result in takeover of MySQL Server or MySQL Cluster. Confidentiality, integrity, and availability can all be affected.