Critical Crash Vulnerability in MariaDB Package: DEBIAN-CVE-2023-52970
Summary
DEBIAN-CVE-2023-52970: MariaDB Server 10.4 through 10.5.*, 10.6 through 10.6.*, 10.7 through 10.11.*, 11.0 through 11.0.*, and 11.1 through 11.4.* crashes in Item_direct_view_ref::derived_field_transformer_for_where. Affects mariadb versions < 1:10.11.13-0+deb12u1. Fixed in 1:10.11.13-0+deb12u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MariaDB is an open-source relational database management system that is widely used for managing and organizing data. It is known for its high performance, scalability, and compatibility with MySQL. The affected versions of MariaDB, specifically from 10.4 to 10.11 and 11.0 to 11.4, have a vulnerability that can lead to crashes under certain conditions, impacting database availability and reliability.
Vulnerability Detail
The vulnerability identified as DEBIAN-CVE-2023-52970 affects multiple versions of MariaDB, specifically versions 10.4 through 10.5., 10.6 through 10.6., 10.7 through 10.11., 11.0 through 11.0., and 11.1 through 11.4.*. It originates from a flaw in the Item_direct_view_ref::derived_field_transformer_for_where function, which can cause the server to crash when certain queries are executed. This can lead to significant downtime and data accessibility issues for applications relying on the database.
How To Fix
Minimum fixed version
1:10.11.13-0+deb12u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade mariadbTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is strongly recommended to apply the patch as soon as possible to mitigate the risk of crashes.
Conclusion
The DEBIAN-CVE-2023-52970 vulnerability poses a significant risk to MariaDB users, potentially leading to server crashes and data accessibility issues. It is imperative to update to the patched versions as soon as possible to ensure the stability and reliability of your database systems.
See every vulnerability recorded for mariadb →
FAQ
It is a vulnerability in MariaDB that can cause the server to crash when certain queries are executed.
Versions 10.4 through 10.5., 10.6 through 10.6., 10.7 through 10.11., 11.0 through 11.0., and 11.1 through 11.4.* are affected.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
While there are no specific workarounds, it is crucial to plan for an update to mitigate the risk of crashes.
You can visit the official MariaDB website or check vulnerability databases like CVE for detailed information.
References
Related vulnerabilities
Recent vulnerabilities recorded for mariadb.
