Moderate Security Update for MariaDB: Addressing Multiple Vulnerabilities
Summary
ALSA-2025:19572: Moderate: mariadb:10.5 security update. Affects Judy across 2 version ranges.
< 1.0.5-18.module_el8.8.0+3620+5d452900
< 1.0.5-18.module_el8.10.0+3947+ac422511
Fixed in 1.0.5-18.module_el8.8.0+3620+5d452900 or 1.0.5-18.module_el8.10.0+3947+ac422511, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MariaDB is a robust, multi-user, multi-threaded SQL database server that is designed to be binary compatible with MySQL. It is widely used for its performance, reliability, and ease of use, making it a popular choice for developers and organizations. However, recent vulnerabilities have been identified that could potentially compromise the security and stability of MariaDB installations.
Vulnerability Detail
The vulnerabilities in MariaDB include a high privilege denial of service vulnerability in MySQL Server (CVE-2025-21490), crashes due to empty backtrace logs (CVE-2023-52969), and crashes via item direct view references (CVE-2023-52970). Additionally, there are unspecified vulnerabilities in mysqldump and InnoDB that could lead to further security issues. These vulnerabilities could allow attackers to exploit the database server, leading to service disruptions and potential data loss.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
sudo dnf update Judy-
< 1.0.5-18.module_el8.8.0+3620+5d4529001.0.5-18.module_el8.8.0+3620+5d452900 -
< 1.0.5-18.module_el8.10.0+3947+ac4225111.0.5-18.module_el8.10.0+3947+ac422511
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate updating is not possible, consider restricting access to the MariaDB server and monitoring logs for unusual activity as a temporary measure until the update can be applied.
Conclusion
The recent vulnerabilities identified in MariaDB pose significant risks to database security and stability. It is crucial for users to update their installations to the latest patched versions to mitigate these risks. Utilizing tools like Vulert can help in monitoring and identifying vulnerabilities in real-time.
See every vulnerability recorded for Judy →
FAQ
The vulnerabilities could lead to denial of service, crashes, and potential data loss, affecting the overall stability and security of the database.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. By uploading your manifest file like package-lock.json to Vulert's playground, you can check for vulnerabilities without needing to install any software.
As a temporary workaround, restrict access to the database server and monitor for any suspicious activity until you can apply the necessary updates.
Yes, versions prior to 3:10.5.29-2.module_el8.10.0+4059+10818090 are affected by the vulnerabilities. Updating to this version or later is recommended.
Detailed information can be found on the CVE pages linked in the advisory, which provide insights into the vulnerabilities and their implications.
Related vulnerabilities
Recent vulnerabilities recorded for Judy.
