Critical Denial of Service Vulnerability in MariaDB - CVE-2018-3282
Summary
ALPINE-CVE-2018-3282: Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Storage Engines). Affects mariadb versions < 10.3.11-r0. Fixed in 10.3.11-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MariaDB is an open-source relational database management system that is widely used for web applications and data storage. It is a fork of MySQL and offers enhanced performance, security, and features. The vulnerability CVE-2018-3282 affects multiple versions of MariaDB, allowing attackers to exploit weaknesses in the server's storage engines, potentially leading to service disruptions.
Vulnerability Detail
CVE-2018-3282 is a vulnerability in the MySQL Server component of Oracle MySQL, specifically affecting the Server: Storage Engines subcomponent. The vulnerability allows a high-privileged attacker with network access to compromise the MySQL Server, resulting in unauthorized ability to cause a hang or frequent crashes, leading to a Denial of Service (DoS). The affected versions include 5.5.61 and prior, 5.6.41 and prior, 5.7.23 and prior, and 8.0.12 and prior. The CVSS score for this vulnerability is 4.9, indicating a moderate risk to availability.
How To Fix
Minimum fixed version
10.3.11-r0
This is the first release that contains the fix.
sudo apk add --upgrade mariadbTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider restricting network access to the MariaDB server to trusted IP addresses only. This can be done by configuring firewall rules to limit access to the database server.
Conclusion
CVE-2018-3282 presents a significant risk to MariaDB users, allowing for potential Denial of Service attacks. It is crucial to update to the patched version to mitigate this vulnerability. Users should also consider implementing network restrictions as a temporary measure until they can apply the update.
See every vulnerability recorded for mariadb →
FAQ
CVE-2018-3282 is a vulnerability in MariaDB that allows attackers to cause a Denial of Service by exploiting weaknesses in the server's storage engines.
The affected versions include MariaDB versions prior to 10.3.11-r0 for Alpine Linux and other versions of MySQL as specified in the vulnerability details.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring access to the code or installation.
The CVSS score for CVE-2018-3282 is 4.9, indicating a moderate risk to availability.
If immediate updates are not possible, implement network restrictions to limit access to the MariaDB server as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for mariadb.
