Segmentation Fault Vulnerability in MariaDB Package: CVE-2022-27386
Summary
ALPINE-CVE-2022-27386: MariaDB Server v10.7 and below was discovered to contain a segmentation fault via the component sql/sql_class.cc. Affects mariadb versions < 10.4.25-r0. Fixed in 10.4.25-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MariaDB is an open-source relational database management system that is widely used for web applications and data storage. It is known for its high performance, scalability, and robustness. However, versions of MariaDB up to 10.7 are vulnerable to a segmentation fault issue, which can lead to application crashes and potential data loss.
Vulnerability Detail
The vulnerability identified as CVE-2022-27386 originates from a segmentation fault in the component sql/sql_class.cc of MariaDB Server versions 10.7 and below. This flaw can be exploited, leading to application instability and crashes, which may result in data loss or corruption. The CVSS score for this vulnerability is 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
10.4.25-r0
This is the first release that contains the fix.
sudo apk add --upgrade mariadbTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the affected features of MariaDB that trigger the segmentation fault until the package is updated. This may involve disabling certain queries or functionalities that rely on the sql/sql_class.cc component.
Conclusion
CVE-2022-27386 represents a significant vulnerability in MariaDB that can lead to application crashes and data loss. It is crucial for users to update to the patched versions of MariaDB to mitigate this risk. Temporary workarounds can be employed until the update is feasible.
See every vulnerability recorded for mariadb →
FAQ
CVE-2022-27386 is a vulnerability in MariaDB that causes a segmentation fault, potentially leading to application crashes.
MariaDB versions 10.7 and below are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The CVSS score of CVE-2022-27386 is 7.5, indicating a high severity level.
If immediate updates are not possible, consider disabling the features that trigger the segmentation fault as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for mariadb.
