Denial of Service Vulnerability in MariaDB Server
Summary
CVE-2022-27380: An issue in the component my_decimal::operator= of MariaDB Server v10.6.3 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL statements. Affects mariadb across 2 version ranges.
< 10.4.25-r0
>= 9664240c948a92c22ccda0e1f5a420eb776ddcb1, < 0ba528fe56f6c637d9fbc9d177a62610038fd519
Fixed in 10.4.25-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MariaDB Server is an open-source relational database management system that is a fork of MySQL. It provides a wide range of features and is widely used in various applications. However, a vulnerability has been discovered in versions 10.6.3 and below that can lead to a Denial of Service (DoS) attack.
Vulnerability Detail
The vulnerability, identified as CVE-2022-27380, resides in the my_decimal::operator= component of MariaDB Server. Attackers can exploit this issue by crafting specially crafted SQL statements. When executed, these statements can cause the server to crash or become unresponsive, resulting in a DoS condition. The impact of this vulnerability can be severe, as it can disrupt the availability of the database and potentially affect the entire application relying on it.
How To Fix
Minimum fixed version
10.4.25-r0
This is the first release that contains the fix.
sudo apk add --upgrade mariadbTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
At present, no known workarounds exist for this vulnerability. It is crucial to apply the recommended fix by upgrading to a patched version of MariaDB Server.
Conclusion
In conclusion, the Denial of Service vulnerability in MariaDB Server can be exploited by attackers through specially crafted SQL statements, leading to server crashes or unresponsiveness. To mitigate this risk, it is essential to upgrade to a fixed version of MariaDB Server. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for mariadb →
FAQ
This vulnerability can lead to a Denial of Service (DoS) attack, causing the MariaDB Server to crash or become unresponsive. This can result in the unavailability of the database and potential disruption of the application relying on it.
You can check the version of MariaDB Server installed on your system and compare it with the affected versions mentioned in the vulnerability details. If your version is equal to or lower than the affected versions, it is recommended to upgrade to a fixed version.
No, currently there are no known workarounds for this vulnerability. The recommended approach is to upgrade to a patched version of MariaDB Server.
Yes, this vulnerability can be exploited remotely by sending specially crafted SQL statements to the vulnerable MariaDB Server.
At the time of this report, there is no evidence of active exploitation of this vulnerability. However, it is crucial to apply the recommended fix to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for mariadb.
