Critical Denial of Service Vulnerability in MariaDB - CVE-2017-3257
Summary
ALPINE-CVE-2017-3257: Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: InnoDB). Affects mariadb versions < 10.1.21-r0. Fixed in 10.1.21-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MariaDB is an open-source relational database management system that is widely used for web applications and data storage. It is a fork of MySQL and is designed to be highly compatible with it, offering enhanced performance and features. The vulnerability CVE-2017-3257 affects multiple versions of MariaDB, allowing attackers to exploit the system and potentially cause a denial of service (DoS) by crashing the server.
Vulnerability Detail
CVE-2017-3257 is a vulnerability in the MySQL Server component of Oracle MySQL, specifically within the InnoDB subcomponent. It affects versions 5.6.34 and earlier, as well as 5.7.16 and earlier. The vulnerability is easily exploitable by low-privileged attackers with network access, allowing them to cause a hang or frequent crashes of the MySQL Server. This results in a denial of service, impacting the availability of the database. The CVSS v3.0 Base Score for this vulnerability is 6.5, indicating a moderate severity level.
How To Fix
Minimum fixed version
10.1.21-r0
This is the first release that contains the fix.
sudo apk add --upgrade mariadbTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot immediately update the package, consider implementing network-level security measures such as firewalls to restrict access to the MariaDB server, thereby reducing the risk of exploitation.
Conclusion
CVE-2017-3257 is a significant vulnerability in MariaDB that can lead to denial of service attacks. It is crucial to update to the patched version to mitigate risks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for mariadb →
FAQ
CVE-2017-3257 is a vulnerability in the MySQL Server component of Oracle MySQL that allows attackers to cause a denial of service by crashing the server.
The vulnerability affects multiple versions of MariaDB, specifically those prior to 10.1.21-r0.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Check your application against the vulnerability using the Vulert playground at Vulert Scanner.
If an immediate update is not possible, implement network security measures to limit access to the MariaDB server.
The CVSS score for CVE-2017-3257 is 6.5, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for mariadb.
