Critical Denial of Service Vulnerability in MariaDB - CVE-2018-2819
Summary
ALPINE-CVE-2018-2819: Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Affects mariadb versions < 10.2.15-r0. Fixed in 10.2.15-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MariaDB is an open-source relational database management system that is widely used for web applications and data storage. It is a fork of MySQL and is designed to be highly compatible with it while offering additional features and improvements. The vulnerability CVE-2018-2819 affects multiple versions of MariaDB, allowing attackers to exploit weaknesses in the InnoDB storage engine, potentially leading to a denial of service (DoS) condition.
Vulnerability Detail
CVE-2018-2819 is a vulnerability in the MySQL Server component of Oracle MySQL, specifically within the InnoDB subcomponent. It affects versions 5.5.59 and earlier, 5.6.39 and earlier, and 5.7.21 and earlier. The vulnerability is easily exploitable by low-privileged attackers with network access via multiple protocols. Successful exploitation can lead to unauthorized actions that may cause the MySQL Server to hang or crash, resulting in a complete denial of service. The CVSS score for this vulnerability is 6.5, indicating a moderate level of risk to availability.
How To Fix
Minimum fixed version
10.2.15-r0
This is the first release that contains the fix.
sudo apk add --upgrade mariadbTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can limit network access to the MariaDB server by configuring firewall rules to restrict access to trusted IP addresses only. This can help mitigate the risk of exploitation until the package is updated.
Conclusion
CVE-2018-2819 is a significant vulnerability affecting multiple versions of MariaDB, posing a risk of denial of service. It is crucial to update to the patched version to mitigate this risk. Additionally, using tools like Vulert can help monitor and alert for vulnerabilities in your software.
See every vulnerability recorded for mariadb →
FAQ
CVE-2018-2819 is a vulnerability in the MySQL Server component of Oracle MySQL that affects MariaDB, allowing attackers to cause a denial of service.
Affected versions include those prior to 10.2.15-r0 for Alpine Linux distributions.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to a denial of service, causing the MySQL Server to hang or crash, which disrupts database operations.
Implement firewall rules to restrict access to the MariaDB server to trusted IP addresses as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for mariadb.
