Vulnerability in Oracle MySQL Server (FTS Component)
Summary
CVE-2022-21427: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: FTS). Affects mariadb across 2 version ranges.
< 10.4.25-r0
>= 9664240c948a92c22ccda0e1f5a420eb776ddcb1, < 0ba528fe56f6c637d9fbc9d177a62610038fd519
Fixed in 10.4.25-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Oracle MySQL Server is a popular open-source relational database management system. It provides a robust and scalable platform for storing and retrieving data. The Full-Text Search (FTS) component in MySQL Server enables efficient searching of text-based data. However, a vulnerability has been discovered in the FTS component of MySQL Server.
Vulnerability Detail
The vulnerability, identified as CVE-2022-21427, affects MySQL Server versions 5.7.37 and prior, as well as 8.0.28 and prior. It is an easily exploitable vulnerability that can be leveraged by a high privileged attacker with network access via multiple protocols. Successful exploitation of this vulnerability can lead to unauthorized ability to cause a hang or frequently repeatable crash (complete denial of service) of the MySQL Server. The Common Vulnerability Scoring System (CVSS) 3.1 Base Score for this vulnerability is 4.9, indicating its impact on availability.
How To Fix
Minimum fixed version
10.4.25-r0
This is the first release that contains the fix.
sudo apk add --upgrade mariadbTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround has been provided for this vulnerability. It is advised to follow the recommended fix and update MySQL Server to a patched version.
Conclusion
In conclusion, a vulnerability has been identified in the FTS component of Oracle MySQL Server. This vulnerability can be exploited by a high privileged attacker to cause a denial of service. It is crucial to update MySQL Server to a patched version to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mariadb →
FAQ
The vulnerability allows a high privileged attacker to cause a denial of service by crashing the MySQL Server.
Users of Oracle MySQL Server versions 5.7.37 and prior, as well as 8.0.28 and prior, are affected by this vulnerability.
At the time of this report, there are no known exploits for this vulnerability. However, it is important to apply the recommended fix to mitigate any potential risks.
Yes, the CVSS 3.1 Base Score for this vulnerability is 4.9, indicating its impact on availability.
You can use Vulert Playground (https://vulert.com/scanner) to check if your MySQL Server installation is affected by this vulnerability. Simply upload your package-lock.json file to the playground and it will provide real-time monitoring and alerts for open-source vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for mariadb.
