A flaw was found in the mysql-wsrep component of mariadb. Lack of input sanitization in `wsrep_sst_method` allows for command injection that can be exploited by a remote attacker to execute arbitrary commands on galera cluster nodes. This threatens the system's confidentiality, integrity, and availability. This flaw affects mariadb versions before 10.1.47, before 10.2.34, before 10.3.25, before 10.4.15 and before 10.5.6.
CVSS Details
- CVSS 3.1 Base Score: 9
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade Judy | May 4, 2022 | May 27, 2021 |
| Alpine Linux | — | Upgrade mariadb | Aug 22, 2024 | May 27, 2021 |
| Centos_linux | — | Upgrade JudyUpgrade mariadb-embedded-debuginfoUpgrade mariadb-errmsgUpgrade mariadb-commonUpgrade mariadb-embedded-develUpgrade mariadb-oqgraph-engine-debuginfoUpgrade mariadb-backupUpgrade Judy-debugsourceUpgrade galera-debuginfoUpgrade mariadb-testUpgrade mariadb-embeddedUpgrade mariadb-test-debuginfoUpgrade mariadb-server-galeraUpgrade mariadb-backup-debuginfoUpgrade mariadb-debugsourceUpgrade mariadb-server-utils-debuginfoUpgrade mariadb-gssapi-server-debuginfoUpgrade Judy-debuginfoUpgrade galera-debugsourceUpgrade mariadbUpgrade galeraUpgrade mariadb-serverUpgrade mariadb-server-utilsUpgrade mariadb-server-debuginfoUpgrade mariadb-oqgraph-engineUpgrade mariadb-debuginfoUpgrade mariadb-gssapi-serverUpgrade mariadb-devel | Dec 21, 2020 | Dec 15, 2020 |
| Debian | — | Upgrade mariadb-10.5 | Oct 22, 2020 | Oct 22, 2020 |
| Freebsd | — | Upgrade mariadb104-clientUpgrade mariadb105-serverUpgrade mariadb103-serverUpgrade mariadb105-clientUpgrade mariadb104-serverUpgrade mariadb103-client | Oct 19, 2020 | Oct 18, 2020 |
| Gentoo Linux | — | Upgrade dev-db/mariadb. | Nov 12, 2020 | Nov 11, 2020 |
| Mariadb Mariadb | — | Upgrade MariaDB to the latest version | Mar 4, 2025 | May 27, 2021 |
| Oracle_linux | — | Upgrade mariadb-testUpgrade mariadb-embedded-develUpgrade mariadb-serverUpgrade mariadb-commonUpgrade mariadb-oqgraph-engineUpgrade mariadb-develUpgrade mariadb-backupUpgrade galeraUpgrade Judy-develUpgrade mariadb-embeddedUpgrade mariadb-errmsgUpgrade JudyUpgrade mariadb-server-utilsUpgrade mariadbUpgrade mariadb-gssapi-serverUpgrade asio-develUpgrade mariadb-server-galera | Dec 18, 2020 | Oct 6, 2020 |
| Redhat_linux | — | Upgrade mariadb-test-debuginfoUpgrade mariadb-embeddedUpgrade mariadb-develUpgrade mariadb-server-utils-debuginfoUpgrade galera-debugsourceUpgrade galeraUpgrade mariadb-backupUpgrade mariadb-server-utilsUpgrade mariadb-server-galeraUpgrade mariadb-server-debuginfoUpgrade mariadb-oqgraph-engineUpgrade mariadb-embedded-develUpgrade Judy-debuginfoUpgrade mariadb-debuginfoUpgrade mariadb-errmsgUpgrade mariadb-serverUpgrade galera-debuginfoUpgrade JudyUpgrade mariadb-testUpgrade mariadb-gssapi-server-debuginfoUpgrade mariadbUpgrade mariadb-debugsourceUpgrade mariadb-oqgraph-engine-debuginfoUpgrade mariadb-gssapi-serverUpgrade mariadb-embedded-debuginfoUpgrade mariadb-backup-debuginfoUpgrade Judy-debugsourceUpgrade mariadb-common | Dec 21, 2020 | Dec 15, 2020 |
| Rocky_linux | — | Upgrade Judy-debuginfoUpgrade Judy-debugsourceUpgrade Judy | Mar 12, 2024 | May 27, 2021 |
| Suse | — | Upgrade libmariadbd-develUpgrade libmariadbd19Upgrade libmariadb_pluginsUpgrade mariadb-clientUpgrade libmysqld19Upgrade mariadb-testUpgrade mariadb-errormessagesUpgrade mariadbUpgrade mariadb-toolsUpgrade mariadb-benchUpgrade libmariadb-develUpgrade libmariadbprivateUpgrade mariadb-rpm-macrosUpgrade mariadb-galeraUpgrade libmariadb3Upgrade libmysqld-develUpgrade libmariadb3-32bit | Nov 25, 2020 | Oct 7, 2020 |
| Ubuntu | — | Upgrade mariadb-server | Oct 28, 2020 | Oct 7, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub