REDHAT-BUG-2505923: Medium severity Oracle MySQL Server vulnerability
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Oracle MySQL (Server: Replication)to a version that resolves this vulnerability.Fixed in 8.4.10 - Upgrade
Upgrade
Oracle MySQL (Server: Replication)to a version that resolves this vulnerability.Fixed in 9.7.1 - Upgrade
Upgrade
Oracle MySQL Cluster (Server: Replication)to a version that resolves this vulnerability.Fixed in 8.0.47 - Upgrade
Upgrade
Oracle MySQL Cluster (Server: Replication)to a version that resolves this vulnerability.Fixed in 8.4.10 - Upgrade
Upgrade
Oracle MySQL Cluster (Server: Replication)to a version that resolves this vulnerability.Fixed in 9.7.1
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
Exploitation requires a high-privileged attacker with network access to the affected MySQL Server or MySQL Cluster through multiple protocols. No user interaction is required, and the vulnerability is rated difficult to exploit.
Which deployments should be prioritized for remediation?
Prioritize affected MySQL Server and MySQL Cluster instances that permit network access by high-privileged users, particularly replication-related deployments. Successful exploitation can result in complete takeover with confidentiality, integrity, and availability impacts.
Which product versions are listed as affected?
Affected MySQL Server versions are 8.4.0 through 8.4.10 and 9.7.0 through 9.7.1. Affected MySQL Cluster versions are 8.0.0 through 8.0.47, 8.4.0 through 8.4.10, and 9.7.0 through 9.7.1.