A flaw was found in the mysql-wsrep component of mariadb. Lack of input sanitization in `wsrep_sst_method` allows for command injection that can be exploited by a remote attacker to execute arbitrary commands on galera cluster nodes. This threatens the system's confidentiality, integrity, and availability. This flaw affects mariadb versions before 10.1.47, before 10.2.34, before 10.3.25, before 10.4.15 and before 10.5.6.
CVSS Details
- CVSS 3.1 Base Score: 9
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade Judy | May 4, 2022 | May 27, 2021 |
| Alpine Linux | — | Upgrade mariadb | Aug 22, 2024 | May 27, 2021 |
| Centos_linux | — | Upgrade mariadb-server-utils-debuginfoUpgrade Judy-debuginfoUpgrade mariadb-embeddedUpgrade galera-debugsourceUpgrade mariadb-gssapi-server-debuginfoUpgrade mariadb-oqgraph-engineUpgrade mariadbUpgrade mariadb-debuginfoUpgrade mariadb-gssapi-serverUpgrade mariadb-backup-debuginfoUpgrade mariadb-debugsourceUpgrade mariadb-server-debuginfoUpgrade mariadb-serverUpgrade mariadb-develUpgrade mariadb-server-utilsUpgrade galeraUpgrade mariadb-server-galeraUpgrade mariadb-test-debuginfoUpgrade mariadb-embedded-develUpgrade mariadb-errmsgUpgrade mariadb-commonUpgrade mariadb-oqgraph-engine-debuginfoUpgrade mariadb-embedded-debuginfoUpgrade mariadb-testUpgrade JudyUpgrade galera-debuginfoUpgrade mariadb-backupUpgrade Judy-debugsource | Dec 21, 2020 | Dec 15, 2020 |
| Debian | — | Upgrade mariadb-10.5 | Oct 22, 2020 | Oct 22, 2020 |
| Freebsd | — | Upgrade mariadb103-serverUpgrade mariadb105-clientUpgrade mariadb104-serverUpgrade mariadb103-clientUpgrade mariadb104-clientUpgrade mariadb105-server | Oct 19, 2020 | Oct 18, 2020 |
| Gentoo Linux | — | Upgrade dev-db/mariadb. | Nov 12, 2020 | Nov 11, 2020 |
| Mariadb Mariadb | — | Upgrade MariaDB to the latest version | Mar 4, 2025 | May 27, 2021 |
| Oracle_linux | — | Upgrade mariadb-gssapi-serverUpgrade mariadb-embeddedUpgrade mariadb-server-utilsUpgrade JudyUpgrade mariadbUpgrade asio-develUpgrade Judy-develUpgrade mariadb-errmsgUpgrade mariadb-server-galeraUpgrade mariadb-backupUpgrade mariadb-testUpgrade galeraUpgrade mariadb-develUpgrade mariadb-commonUpgrade mariadb-embedded-develUpgrade mariadb-oqgraph-engineUpgrade mariadb-server | Dec 18, 2020 | Oct 6, 2020 |
| Redhat_linux | — | Upgrade mariadb-server-utils-debuginfoUpgrade mariadb-embeddedUpgrade mariadb-errmsgUpgrade mariadb-backupUpgrade mariadb-test-debuginfoUpgrade mariadb-develUpgrade galeraUpgrade mariadb-debuginfoUpgrade mariadb-server-utilsUpgrade mariadb-server-galeraUpgrade mariadb-serverUpgrade Judy-debuginfoUpgrade galera-debugsourceUpgrade mariadb-embedded-develUpgrade mariadb-oqgraph-engineUpgrade mariadb-server-debuginfoUpgrade JudyUpgrade galera-debuginfoUpgrade mariadb-testUpgrade mariadb-oqgraph-engine-debuginfoUpgrade mariadb-commonUpgrade mariadb-debugsourceUpgrade mariadb-gssapi-server-debuginfoUpgrade Judy-debugsourceUpgrade mariadb-backup-debuginfoUpgrade mariadb-embedded-debuginfoUpgrade mariadb-gssapi-serverUpgrade mariadb | Dec 21, 2020 | Dec 15, 2020 |
| Rocky_linux | — | Upgrade JudyUpgrade Judy-debugsourceUpgrade Judy-debuginfo | Mar 12, 2024 | May 27, 2021 |
| Suse | — | Upgrade libmariadb3Upgrade mariadb-benchUpgrade mariadb-galeraUpgrade libmariadb-develUpgrade libmariadb3-32bitUpgrade libmariadbprivateUpgrade libmysqld-develUpgrade mariadb-rpm-macrosUpgrade mariadbUpgrade mariadb-clientUpgrade libmysqld19Upgrade mariadb-testUpgrade mariadb-toolsUpgrade libmariadb_pluginsUpgrade libmariadbd-develUpgrade libmariadbd19Upgrade mariadb-errormessages | Nov 25, 2020 | Oct 7, 2020 |
| Ubuntu | — | Upgrade mariadb-server | Oct 28, 2020 | Oct 7, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub