REDHAT-BUG-2557589: Medium severity Oracle MySQL Server vulnerability
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs network access to the affected MySQL Server or MySQL Cluster instance and low-privileged credentials. No user interaction is required, and the attack complexity is low.
What is the expected impact of a successful attack?
A successful attack can cause a server or cluster hang or a frequently repeatable crash, resulting in complete denial of service. The supplied CVSS vector indicates no confidentiality or integrity impact.
How can I determine whether an installation is affected?
Compare the deployed product and version with the affected ranges. MySQL Server is affected in 8.4.0 through 8.4.12, 9.7.0 through 9.7.3, and 26.7.0 through 26.7.1; MySQL Cluster is also affected in 8.0.0 through 8.0.49.
Is exploitation limited to a particular network protocol?
No. The issue is described as reachable over multiple protocols, so exposure should be evaluated for all network-accessible MySQL Server or MySQL Cluster services.