REDHAT-BUG-640845: Medium severity mysql (mysql-common) vulnerability
A flaw in MySQL versions prior to 5.1.51 [1] was reported [2] that could allow an authenticated user to kill connections to MySQL. Upstream describes the problem as follows:
IN quantified predicates are never executed directly. They are rather wrapped inside nodes called IN Optimizers (Iteminoptimizer) which take care of the execution. However, this is not done during view preparation. Unfortunately the LIKE predicate pre-evaluates constant right-hand side arguments even during name resolution within view preparation. Likely this is meant as an optimization.
There is a patch for this available [3].
[1] http://dev.mysql.com/doc/refman/5.1/en/news-5-1-51.html [2] http://bugs.mysql.com/bug.php?id=54568 [3] http://lists.mysql.com/commits/112602
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-640845?
The severity of REDHAT-BUG-640845 is considered high due to the potential for authenticated users to disrupt MySQL connections.
How do I fix REDHAT-BUG-640845?
To fix REDHAT-BUG-640845, you should upgrade MySQL to version 5.1.51 or later.
What versions are affected by REDHAT-BUG-640845?
REDHAT-BUG-640845 affects MySQL versions prior to 5.1.51.
What is the impact of REDHAT-BUG-640845?
The impact of REDHAT-BUG-640845 is that it allows authenticated users to kill active connections to the MySQL server.
Is there a workaround for REDHAT-BUG-640845?
Currently, there is no official workaround for REDHAT-BUG-640845; upgrading is recommended.