Critical Crash Vulnerability in MariaDB Server: CVE-2023-52971
Summary
CVE-2023-52971: MariaDB Server 10.10 through 10.11.* and 11.0 through 11.4.* crashes in JOIN::fix_all_splittings_in_plan. Affects mariadb versions < 1:10.11.13-0+deb12u1. Fixed in 1:10.11.13-0+deb12u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
MariaDB is an open-source relational database management system that is widely used as a drop-in replacement for MySQL. It offers features such as improved performance, scalability, and security. The affected versions of MariaDB Server, specifically 10.10 through 10.11.* and 11.0 through 11.4.*, are known to crash under certain conditions, which can lead to service disruptions.
Vulnerability Detail
CVE-2023-52971 is a critical vulnerability that arises from a flaw in the JOIN::fix_all_splittings_in_plan function within MariaDB Server. This vulnerability can cause the server to crash when executing specific JOIN operations, potentially leading to data loss and service unavailability. The issue affects multiple versions of MariaDB, making it a significant concern for users relying on these versions for their database operations.
How To Fix
Minimum fixed version
1:10.11.13-0+deb12u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade mariadbTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid executing complex JOIN operations that may trigger the crash until the patch is applied. Additionally, consider implementing database replication or failover strategies to minimize downtime during this vulnerability's impact.
Conclusion
CVE-2023-52971 represents a critical vulnerability in MariaDB Server that can lead to server crashes during specific operations. It is essential for users to update their installations to the latest patched versions to mitigate risks associated with this vulnerability. Temporary workarounds can help minimize disruptions until a full update is applied.
See every vulnerability recorded for mariadb →
FAQ
CVE-2023-52971 is a vulnerability in MariaDB Server that can cause the server to crash during specific JOIN operations.
The affected versions include MariaDB Server 10.10 through 10.11.* and 11.0 through 11.4.*.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, avoid executing complex JOIN operations and consider implementing failover strategies.
More information can be found in the official CVE database or by visiting the source link provided in the vulnerability details.
Related vulnerabilities
Recent vulnerabilities recorded for mariadb.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
