A flaw was found in the mysql-wsrep component of mariadb. Lack of input sanitization in `wsrep_sst_method` allows for command injection that can be exploited by a remote attacker to execute arbitrary commands on galera cluster nodes. This threatens the system's confidentiality, integrity, and availability. This flaw affects mariadb versions before 10.1.47, before 10.2.34, before 10.3.25, before 10.4.15 and before 10.5.6.
CVSS Details
- CVSS 3.1 Base Score: 9
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade Judy | May 4, 2022 | May 27, 2021 |
| Alpine Linux | — | Upgrade mariadb | Aug 22, 2024 | May 27, 2021 |
| Centos_linux | — | Upgrade mariadb-develUpgrade mariadb-serverUpgrade mariadb-debuginfoUpgrade mariadbUpgrade mariadb-oqgraph-engineUpgrade mariadb-gssapi-serverUpgrade mariadb-gssapi-server-debuginfoUpgrade mariadb-server-utils-debuginfoUpgrade galeraUpgrade mariadb-server-debuginfoUpgrade mariadb-test-debuginfoUpgrade galera-debugsourceUpgrade Judy-debuginfoUpgrade mariadb-server-utilsUpgrade mariadb-backup-debuginfoUpgrade mariadb-server-galeraUpgrade mariadb-debugsourceUpgrade mariadb-embeddedUpgrade mariadb-oqgraph-engine-debuginfoUpgrade mariadb-embedded-debuginfoUpgrade JudyUpgrade mariadb-embedded-develUpgrade mariadb-backupUpgrade Judy-debugsourceUpgrade mariadb-commonUpgrade mariadb-errmsgUpgrade galera-debuginfoUpgrade mariadb-test | Dec 21, 2020 | Dec 15, 2020 |
| Debian | — | Upgrade mariadb-10.5 | Oct 22, 2020 | Oct 22, 2020 |
| Freebsd | — | Upgrade mariadb104-clientUpgrade mariadb105-serverUpgrade mariadb103-clientUpgrade mariadb103-serverUpgrade mariadb105-clientUpgrade mariadb104-server | Oct 19, 2020 | Oct 18, 2020 |
| Gentoo Linux | — | Upgrade dev-db/mariadb. | Nov 12, 2020 | Nov 11, 2020 |
| Mariadb Mariadb | — | Upgrade MariaDB to the latest version | Mar 4, 2025 | May 27, 2021 |
| Oracle_linux | — | Upgrade mariadb-oqgraph-engineUpgrade mariadb-testUpgrade mariadb-commonUpgrade galeraUpgrade mariadb-serverUpgrade mariadb-embedded-develUpgrade mariadb-develUpgrade mariadb-backupUpgrade asio-develUpgrade mariadb-gssapi-serverUpgrade JudyUpgrade mariadb-server-utilsUpgrade mariadb-embeddedUpgrade mariadbUpgrade mariadb-server-galeraUpgrade mariadb-errmsgUpgrade Judy-devel | Dec 18, 2020 | Oct 6, 2020 |
| Redhat_linux | — | Upgrade mariadb-backup-debuginfoUpgrade JudyUpgrade mariadb-embedded-debuginfoUpgrade mariadb-oqgraph-engine-debuginfoUpgrade mariadb-gssapi-serverUpgrade mariadb-gssapi-server-debuginfoUpgrade galera-debuginfoUpgrade mariadb-debugsourceUpgrade Judy-debugsourceUpgrade mariadbUpgrade mariadb-commonUpgrade mariadb-testUpgrade mariadb-embedded-develUpgrade Judy-debuginfoUpgrade mariadb-serverUpgrade mariadb-server-utilsUpgrade mariadb-server-utils-debuginfoUpgrade mariadb-embeddedUpgrade galeraUpgrade mariadb-test-debuginfoUpgrade mariadb-backupUpgrade mariadb-server-debuginfoUpgrade mariadb-errmsgUpgrade mariadb-develUpgrade mariadb-oqgraph-engineUpgrade mariadb-server-galeraUpgrade galera-debugsourceUpgrade mariadb-debuginfo | Dec 21, 2020 | Dec 15, 2020 |
| Rocky_linux | — | Upgrade Judy-debuginfoUpgrade Judy-debugsourceUpgrade Judy | Mar 12, 2024 | May 27, 2021 |
| Suse | — | Upgrade mariadbUpgrade mariadb-testUpgrade mariadb-errormessagesUpgrade libmariadbd19Upgrade libmariadbd-develUpgrade mariadb-clientUpgrade libmysqld19Upgrade libmariadb_pluginsUpgrade mariadb-toolsUpgrade libmysqld-develUpgrade mariadb-rpm-macrosUpgrade mariadb-benchUpgrade libmariadb3Upgrade libmariadbprivateUpgrade libmariadb-develUpgrade libmariadb3-32bitUpgrade mariadb-galera | Nov 25, 2020 | Oct 7, 2020 |
| Ubuntu | — | Upgrade mariadb-server | Oct 28, 2020 | Oct 7, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub