REDHAT-BUG-2557856: High severity Oracle MySQL Server vulnerability
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication GCS). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this vulnerability?
Affected deployments are MySQL Server 8.4.0 through 8.4.12, 9.7.0 through 9.7.3, and 26.7.0 through 26.7.1, plus MySQL Cluster 8.0.0 through 8.0.49 and the listed 8.4, 9.7, and 26.7 ranges. Exposure requires an attacker to have access to the physical communication segment connected to the host running the affected service.
Does exploitation require MySQL credentials or user interaction?
No. The vulnerability is described as unauthenticated, with no privileges or user interaction required; its CVSS vector specifies adjacent-network access, low attack complexity, PR:N, and UI:N.
What is the potential impact of a successful attack?
A successful attack can result in takeover of MySQL Server or MySQL Cluster. The reported CVSS impacts are high for confidentiality, integrity, and availability.