Critical Denial of Service Vulnerability in MariaDB - CVE-2018-3156
Summary
ALPINE-CVE-2018-3156: Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Affects mariadb versions < 10.3.11-r0. Fixed in 10.3.11-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MariaDB is an open-source relational database management system that is widely used for web applications and data storage. It is a fork of MySQL and offers enhanced features, performance improvements, and a community-driven development model. This vulnerability affects multiple versions of MariaDB, making it crucial for users to understand its implications and take necessary actions.
Vulnerability Detail
CVE-2018-3156 is a vulnerability in the MySQL Server component of Oracle MySQL, specifically within the InnoDB subcomponent. It affects versions 5.6.41 and prior, 5.7.23 and prior, and 8.0.12 and prior. The vulnerability allows a low-privileged attacker with network access to exploit the MySQL Server, potentially leading to a denial of service (DoS) by causing the server to hang or crash repeatedly. The CVSS score for this vulnerability is 6.5, indicating a moderate risk to availability.
How To Fix
Minimum fixed version
10.3.11-r0
This is the first release that contains the fix.
sudo apk add --upgrade mariadbTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider restricting network access to the MariaDB server to trusted IP addresses only. This can help mitigate the risk of exploitation until the package is updated.
Conclusion
CVE-2018-3156 presents a significant risk to users of MariaDB, allowing potential denial of service attacks. It is essential to update to the patched version to mitigate this vulnerability and ensure the security and availability of your database services.
See every vulnerability recorded for mariadb →
FAQ
CVE-2018-3156 is a vulnerability in the MySQL Server component of Oracle MySQL that allows low-privileged attackers to cause a denial of service.
Affected versions include those prior to 10.3.11-r0 for Alpine Linux distributions.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If immediate updates are not possible, restrict network access to the MariaDB server to minimize exposure to potential attacks.
The CVSS score for CVE-2018-3156 is 6.5, indicating a moderate risk to availability.
References
Related vulnerabilities
Recent vulnerabilities recorded for mariadb.
