Critical Vulnerability in MariaDB Packages: Denial of Service Risk
Summary
DEBIAN-CVE-2023-22084: Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Affects mariadb versions < 1:10.11.6-0+deb12u1. Fixed in 1:10.11.6-0+deb12u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
MariaDB is an open-source relational database management system that is widely used for web applications and data storage. It is a fork of MySQL and offers enhanced features and performance. The affected versions of MariaDB include 10.5 and 10.11 across various Debian releases. This vulnerability allows high-privileged attackers to exploit the database server, leading to potential service disruptions.
Vulnerability Detail
The vulnerability identified as CVE-2023-22084 affects the MySQL Server component of Oracle MySQL, specifically in the InnoDB storage engine. Supported versions that are impacted include MySQL 5.7.43 and earlier, 8.0.34 and earlier, and 8.1.0. The vulnerability is easily exploitable by attackers with network access, allowing them to cause a denial of service (DoS) by hanging or crashing the MySQL Server. The CVSS 3.1 Base Score for this vulnerability is 4.9, indicating a moderate impact on availability.
How To Fix
Minimum fixed version
1:10.11.6-0+deb12u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade mariadbTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider restricting network access to the MariaDB server to trusted IP addresses only, thereby reducing the risk of exploitation until the package is updated.
Conclusion
In summary, CVE-2023-22084 poses a significant risk to MariaDB installations across various Debian versions. It is crucial to update to the patched versions as soon as possible to mitigate the risk of denial of service attacks. Implementing network restrictions can serve as a temporary workaround until updates are applied.
See every vulnerability recorded for mariadb →
FAQ
CVE-2023-22084 is a vulnerability in the MySQL Server component of Oracle MySQL that allows attackers to cause a denial of service.
Affected versions include MariaDB 10.5 and 10.11 across Debian 11, 12, 13, and 14.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without needing to sign up.
If immediate updates are not possible, restrict network access to the MariaDB server to minimize exposure.
Exploitation of this vulnerability can lead to unauthorized denial of service, causing the MySQL Server to hang or crash.
References
Related vulnerabilities
Recent vulnerabilities recorded for mariadb.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
