Vulnerability in MySQL Server component of Oracle MySQL
Summary
CVE-2017-10378: Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Affects mariadb across 3 version ranges.
>= 5bfe1a3917ee1bddc7f2cde0c88961875148873c, < 1da916c37e5107b27297fc9e22c3da7772bb097d
< 10.1.32-r0
>= 54df0057e18d8c82c23fbd4e0bf5b5dc2e762955, < 1da916c37e5107b27297fc9e22c3da7772bb097d
Fixed in 10.1.32-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The MySQL Server is a popular open-source relational database management system. It is widely used for storing and retrieving data in various applications. The vulnerability affects versions 5.5.57 and earlier, 5.6.37 and earlier, and 5.7.11 and earlier. This vulnerability specifically targets the Optimizer component of the MySQL Server. The Optimizer is responsible for optimizing query execution plans to improve database performance.
Vulnerability Detail
The vulnerability allows a low privileged attacker with network access via multiple protocols to compromise the MySQL Server. By exploiting this vulnerability, an attacker can cause a hang or frequently repeatable crash of the MySQL Server, resulting in a denial of service (DoS) condition. The impact of this vulnerability is limited to availability, with a CVSS 3.0 Base Score of 6.5. The vulnerability has been assigned the identifier CVE-2017-10378.
How To Fix
Minimum fixed version
10.1.32-r0
This is the first release that contains the fix.
sudo apk add --upgrade mariadbTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix provided by Oracle MySQL to address the issue.
Conclusion
The vulnerability in the MySQL Server Optimizer component can be exploited by a low privileged attacker to cause a DoS condition. It is important to upgrade to a fixed version of MySQL Server to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mariadb →
FAQ
The vulnerability allows an attacker to cause a DoS condition by crashing the MySQL Server.
Users of Oracle MySQL Server versions 5.5.57 and earlier, 5.6.37 and earlier, and 5.7.11 and earlier are affected by this vulnerability.
No, a low privileged attacker with network access can exploit this vulnerability.
The recommended mitigation is to upgrade to a fixed version of MySQL Server.
There is no evidence of active exploitation of this vulnerability at the time of this report.
Related vulnerabilities
Recent vulnerabilities recorded for mariadb.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
