Critical Vulnerability in MariaDB: Unauthorized Access Risk Due to MySQL Server Flaw
Summary
ALPINE-CVE-2017-3313: Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: MyISAM). Affects mariadb versions < 10.1.22-r0. Fixed in 10.1.22-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MariaDB is an open-source relational database management system that is widely used for web applications and data storage. It is a fork of MySQL and offers enhanced features and performance improvements. The package is known for its robustness, scalability, and compatibility with MySQL. However, it is susceptible to vulnerabilities that can compromise the integrity and confidentiality of the data it manages.
Vulnerability Detail
The vulnerability identified as CVE-2017-3313 affects the MySQL Server component of Oracle MySQL, specifically in the MyISAM subcomponent. It impacts supported versions of MySQL Server, including 5.5.53 and earlier, 5.6.34 and earlier, and 5.7.16 and earlier. This vulnerability allows a low-privileged attacker with access to the infrastructure where MySQL Server runs to exploit the flaw, potentially leading to unauthorized access to critical data or complete access to all MySQL Server accessible data. The CVSS v3.0 Base Score for this vulnerability is 4.7, indicating a moderate risk to confidentiality.
How To Fix
Minimum fixed version
10.1.22-r0
This is the first release that contains the fix.
sudo apk add --upgrade mariadbTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider restricting access to the MySQL Server by implementing stricter firewall rules or limiting user permissions to mitigate the risk of exploitation until the patch can be applied.
Conclusion
CVE-2017-3313 represents a significant vulnerability in the MariaDB package that can lead to unauthorized access to sensitive data. It is crucial to update to the patched version 10.1.22-r0 to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor and alert for open-source vulnerabilities in your software.
See every vulnerability recorded for mariadb →
FAQ
CVE-2017-3313 is a vulnerability in the MySQL Server component of Oracle MySQL that allows unauthorized access to data due to a flaw in the MyISAM subcomponent.
The vulnerability affects MariaDB versions that are based on MySQL versions 5.5.53 and earlier, 5.6.34 and earlier, and 5.7.16 and earlier.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Update your MariaDB package to the fixed version 10.1.22-r0 and consider implementing stricter access controls and firewall rules as a temporary measure.
The CVSS v3.0 Base Score for CVE-2017-3313 is 4.7, indicating a moderate risk to confidentiality.
References
Related vulnerabilities
Recent vulnerabilities recorded for mariadb.
