A flaw was found in the mysql-wsrep component of mariadb. Lack of input sanitization in `wsrep_sst_method` allows for command injection that can be exploited by a remote attacker to execute arbitrary commands on galera cluster nodes. This threatens the system's confidentiality, integrity, and availability. This flaw affects mariadb versions before 10.1.47, before 10.2.34, before 10.3.25, before 10.4.15 and before 10.5.6.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade Judy | May 4, 2022 | May 27, 2021 |
| Alpine Linux | — | Upgrade mariadb | Aug 22, 2024 | May 27, 2021 |
| Centos_linux | — | Upgrade Judy-debugsourceUpgrade mariadb-embedded-debuginfoUpgrade JudyUpgrade mariadb-oqgraph-engine-debuginfoUpgrade mariadb-backupUpgrade mariadb-testUpgrade mariadb-embedded-develUpgrade mariadb-commonUpgrade galera-debuginfoUpgrade mariadb-errmsgUpgrade mariadb-develUpgrade mariadb-gssapi-serverUpgrade mariadb-serverUpgrade mariadbUpgrade mariadb-debuginfoUpgrade Judy-debuginfoUpgrade mariadb-gssapi-server-debuginfoUpgrade galera-debugsourceUpgrade mariadb-debugsourceUpgrade mariadb-backup-debuginfoUpgrade mariadb-server-utils-debuginfoUpgrade mariadb-embeddedUpgrade galeraUpgrade mariadb-test-debuginfoUpgrade mariadb-server-galeraUpgrade mariadb-server-utilsUpgrade mariadb-server-debuginfoUpgrade mariadb-oqgraph-engine | Dec 21, 2020 | Dec 15, 2020 |
| Debian | — | Upgrade mariadb-10.5 | Oct 22, 2020 | Oct 22, 2020 |
| Freebsd | — | Upgrade mariadb103-serverUpgrade mariadb104-serverUpgrade mariadb103-clientUpgrade mariadb105-clientUpgrade mariadb105-serverUpgrade mariadb104-client | Oct 19, 2020 | Oct 18, 2020 |
| Gentoo Linux | — | Upgrade dev-db/mariadb. | Nov 12, 2020 | Nov 11, 2020 |
| Mariadb Mariadb | — | Upgrade MariaDB to the latest version | Mar 4, 2025 | May 27, 2021 |
| Oracle_linux | — | Upgrade mariadb-testUpgrade mariadb-embedded-develUpgrade mariadb-commonUpgrade mariadb-oqgraph-engineUpgrade mariadb-backupUpgrade mariadb-serverUpgrade galeraUpgrade mariadb-develUpgrade Judy-develUpgrade JudyUpgrade mariadb-errmsgUpgrade mariadb-gssapi-serverUpgrade mariadbUpgrade mariadb-server-utilsUpgrade mariadb-embeddedUpgrade mariadb-server-galeraUpgrade asio-devel | Dec 18, 2020 | Oct 6, 2020 |
| Redhat_linux | — | Upgrade JudyUpgrade mariadb-gssapi-server-debuginfoUpgrade mariadb-gssapi-serverUpgrade mariadb-debugsourceUpgrade mariadb-oqgraph-engine-debuginfoUpgrade mariadbUpgrade mariadb-embedded-debuginfoUpgrade mariadb-commonUpgrade mariadb-testUpgrade galera-debuginfoUpgrade mariadb-backup-debuginfoUpgrade Judy-debugsourceUpgrade Judy-debuginfoUpgrade mariadb-server-galeraUpgrade mariadb-develUpgrade galera-debugsourceUpgrade mariadb-embeddedUpgrade mariadb-server-utils-debuginfoUpgrade mariadb-backupUpgrade mariadb-server-debuginfoUpgrade mariadb-test-debuginfoUpgrade mariadb-serverUpgrade mariadb-debuginfoUpgrade mariadb-oqgraph-engineUpgrade galeraUpgrade mariadb-embedded-develUpgrade mariadb-errmsgUpgrade mariadb-server-utils | Dec 21, 2020 | Dec 15, 2020 |
| Rocky_linux | — | Upgrade Judy-debuginfoUpgrade Judy-debugsourceUpgrade Judy | Mar 12, 2024 | May 27, 2021 |
| Suse | — | Upgrade libmysqld19Upgrade mariadb-testUpgrade mariadb-errormessagesUpgrade libmariadb_pluginsUpgrade libmariadbd-develUpgrade mariadb-clientUpgrade libmariadbd19Upgrade mariadbUpgrade mariadb-toolsUpgrade libmysqld-develUpgrade libmariadb3-32bitUpgrade mariadb-rpm-macrosUpgrade mariadb-galeraUpgrade libmariadb3Upgrade mariadb-benchUpgrade libmariadb-develUpgrade libmariadbprivate | Nov 25, 2020 | Oct 7, 2020 |
| Ubuntu | — | Upgrade mariadb-server | Oct 28, 2020 | Oct 7, 2020 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub