Application Crash in MariaDB through SELECT Statements (CVE-2021-46663)
Summary
CVE-2021-46663: MariaDB through 10.5.13 allows a ha_maria::extra application crash via certain SELECT statements. Affects mariadb across 2 version ranges.
< 10.4.24-r0
>= 561b6c7e513abc4ceba263252b519bf715ce80f4, < 3a52569499e2f0c4d1f25db1e81617a9d9755400
Fixed in 10.4.24-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MariaDB is an open-source relational database management system (RDBMS) that is a fork of MySQL. It provides a wide range of features and is commonly used in web applications. However, a vulnerability has been discovered in MariaDB versions up to 10.5.13 that can lead to an application crash when certain SELECT statements are executed.
Vulnerability Detail
The vulnerability, identified as CVE-2021-46663, originates from a flaw in the ha_maria::extra component of MariaDB. By crafting specific SELECT statements, an attacker can trigger an application crash. This can potentially lead to a denial-of-service (DoS) condition, impacting the availability of the affected system. The vulnerability has a CVSSv3 score of 5.5, indicating a moderate severity.
How To Fix
Minimum fixed version
10.4.24-r0
This is the first release that contains the fix.
sudo apk add --upgrade mariadbTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is necessary to update MariaDB to the fixed versions.
Conclusion
The vulnerability in MariaDB through SELECT statements can lead to an application crash and potential denial-of-service (DoS) conditions. To mitigate this vulnerability, it is crucial to update MariaDB to the fixed versions mentioned. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for mariadb →
FAQ
MariaDB is an open-source relational database management system (RDBMS) that is a fork of MySQL. It provides a wide range of features and is commonly used in web applications.
The vulnerability can lead to an application crash, potentially causing a denial-of-service (DoS) condition and impacting the availability of the affected system.
To fix this vulnerability, it is recommended to update MariaDB to the fixed versions: 10.4.24-r0 or later for Alpine v3.12, 10.5.15-r0 or later for Alpine v3.13 and v3.14, or 10.6.7-r0 or later for Alpine v3.15 and later versions.
No, there is no known workaround for this vulnerability. Updating to the fixed versions is necessary.
The CVSSv3 score of this vulnerability is 5.5, indicating a moderate severity.
Related vulnerabilities
Recent vulnerabilities recorded for mariadb.
