Critical Denial of Service Vulnerability in MariaDB Affected Versions
Summary
ALPINE-CVE-2021-2154: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Affects mariadb versions < 10.3.29-r0. Fixed in 10.3.29-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
MariaDB is an open-source relational database management system that is widely used for web applications and data storage. It is a fork of MySQL and offers enhanced features, performance, and security. The vulnerability in question affects multiple versions of MariaDB across various Alpine Linux distributions, making it crucial for users to be aware of the potential risks associated with this issue.
Vulnerability Detail
The vulnerability identified as CVE-2021-2154 exists in the MySQL Server component of Oracle MySQL, which is also present in MariaDB. It allows a high-privileged attacker with network access to exploit the server via multiple protocols. Successful exploitation can lead to a denial of service (DoS) condition, causing the MySQL Server to hang or crash repeatedly. This vulnerability affects versions 5.7.33 and prior, with a CVSS 3.1 Base Score of 4.9, indicating a moderate risk to availability.
How To Fix
Minimum fixed version
10.3.29-r0
This is the first release that contains the fix.
sudo apk add --upgrade mariadbTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict network access to the MariaDB server to trusted hosts only, thereby minimizing the risk of exploitation until the package can be updated.
Conclusion
In summary, CVE-2021-2154 is a critical vulnerability affecting multiple versions of MariaDB in Alpine Linux distributions, allowing for potential denial of service attacks. Users are advised to update their packages to the latest patched versions to mitigate risks.
See every vulnerability recorded for mariadb →
FAQ
CVE-2021-2154 is a vulnerability affecting MariaDB and MySQL that allows high-privileged attackers to cause a denial of service.
Affected versions include MariaDB in Alpine Linux distributions prior to the patched versions specified in the report.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The vulnerability can lead to a denial of service, causing the MariaDB server to hang or crash, which can disrupt application availability.
You can update your MariaDB package using the apk command in Alpine Linux, specifying the fixed version as detailed in the 'how_to_fix' section.
References
Related vulnerabilities
Recent vulnerabilities recorded for mariadb.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
