Denial of Service Vulnerability in MariaDB Server
Summary
CVE-2022-27379: An issue in the component Arg_comparator::compare_real_fixed of MariaDB Server v10.6.2 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL statements. Affects mariadb across 2 version ranges.
< 10.4.25-r0
>= 20ae591abd0bfe1bfaee546989ee163f4ef832b1, < a0d4f0f306c6e478a1f45727e8fd9c867f9672d9
Fixed in 10.4.25-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MariaDB Server is an open-source relational database management system that is a drop-in replacement for MySQL. It provides a wide range of features and is widely used in various applications. However, a vulnerability has been discovered in versions 10.6.2 and below, which can lead to a Denial of Service (DoS) attack.
Vulnerability Detail
The vulnerability, identified as CVE-2022-27379, exists in the Arg_comparator::compare_real_fixed component of MariaDB Server. Attackers can exploit this issue by crafting specially crafted SQL statements. This can result in a DoS condition, causing the server to become unresponsive or crash. The vulnerability has a CVSSv3 score of 7.5, indicating a high severity.
How To Fix
Minimum fixed version
10.4.25-r0
This is the first release that contains the fix.
sudo apk add --upgrade mariadbTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by updating MariaDB Server to the patched versions.
Conclusion
The Denial of Service vulnerability in MariaDB Server can be exploited by attackers to cause service unavailability or server crashes. It is recommended to update MariaDB Server to the patched versions mentioned above to mitigate this vulnerability. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mariadb →
FAQ
The vulnerability can be exploited by attackers to cause a DoS condition, potentially leading to service unavailability or server crashes.
No, authentication is not required to exploit this vulnerability. Attackers can exploit it remotely.
No, only versions 10.6.2 and below are affected. Updating to the recommended patched versions will mitigate the vulnerability.
At the time of this report, there is no known public exploit for this vulnerability.
No, network security measures alone cannot mitigate this vulnerability. It is crucial to update MariaDB Server to the patched versions.
Related vulnerabilities
Recent vulnerabilities recorded for mariadb.
