A flaw was found in the mysql-wsrep component of mariadb. Lack of input sanitization in `wsrep_sst_method` allows for command injection that can be exploited by a remote attacker to execute arbitrary commands on galera cluster nodes. This threatens the system's confidentiality, integrity, and availability. This flaw affects mariadb versions before 10.1.47, before 10.2.34, before 10.3.25, before 10.4.15 and before 10.5.6.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade Judy | May 4, 2022 | May 27, 2021 |
| Alpine Linux | — | Upgrade mariadb | Aug 22, 2024 | May 27, 2021 |
| Centos_linux | — | Upgrade mariadb-debugsourceUpgrade mariadb-debuginfoUpgrade mariadb-gssapi-serverUpgrade mariadb-backup-debuginfoUpgrade mariadb-oqgraph-engineUpgrade mariadbUpgrade mariadb-embeddedUpgrade mariadb-server-utilsUpgrade mariadb-server-galeraUpgrade mariadb-develUpgrade mariadb-serverUpgrade mariadb-server-debuginfoUpgrade mariadb-test-debuginfoUpgrade Judy-debuginfoUpgrade mariadb-gssapi-server-debuginfoUpgrade galera-debugsourceUpgrade mariadb-server-utils-debuginfoUpgrade galeraUpgrade mariadb-commonUpgrade mariadb-errmsgUpgrade galera-debuginfoUpgrade mariadb-oqgraph-engine-debuginfoUpgrade mariadb-testUpgrade mariadb-embedded-debuginfoUpgrade JudyUpgrade mariadb-backupUpgrade Judy-debugsourceUpgrade mariadb-embedded-devel | Dec 21, 2020 | Dec 15, 2020 |
| Debian | — | Upgrade mariadb-10.5 | Oct 22, 2020 | Oct 22, 2020 |
| Freebsd | — | Upgrade mariadb104-clientUpgrade mariadb105-serverUpgrade mariadb103-serverUpgrade mariadb104-serverUpgrade mariadb105-clientUpgrade mariadb103-client | Oct 19, 2020 | Oct 18, 2020 |
| Gentoo Linux | — | Upgrade dev-db/mariadb. | Nov 12, 2020 | Nov 11, 2020 |
| Mariadb Mariadb | — | Upgrade MariaDB to the latest version | Mar 4, 2025 | May 27, 2021 |
| Oracle_linux | — | Upgrade mariadb-server-galeraUpgrade asio-develUpgrade mariadb-errmsgUpgrade mariadb-embeddedUpgrade mariadb-gssapi-serverUpgrade mariadbUpgrade Judy-develUpgrade mariadb-server-utilsUpgrade JudyUpgrade mariadb-commonUpgrade mariadb-testUpgrade galeraUpgrade mariadb-oqgraph-engineUpgrade mariadb-embedded-develUpgrade mariadb-develUpgrade mariadb-backupUpgrade mariadb-server | Dec 18, 2020 | Oct 6, 2020 |
| Redhat_linux | — | Upgrade galeraUpgrade mariadb-errmsgUpgrade mariadb-embedded-develUpgrade Judy-debuginfoUpgrade mariadb-server-galeraUpgrade mariadb-embeddedUpgrade mariadb-backupUpgrade mariadb-server-debuginfoUpgrade mariadb-develUpgrade mariadb-debuginfoUpgrade mariadb-serverUpgrade mariadb-test-debuginfoUpgrade mariadb-server-utils-debuginfoUpgrade mariadb-server-utilsUpgrade mariadb-oqgraph-engineUpgrade galera-debugsourceUpgrade mariadb-testUpgrade mariadb-gssapi-server-debuginfoUpgrade mariadb-oqgraph-engine-debuginfoUpgrade mariadb-debugsourceUpgrade mariadbUpgrade mariadb-embedded-debuginfoUpgrade mariadb-backup-debuginfoUpgrade Judy-debugsourceUpgrade JudyUpgrade mariadb-commonUpgrade mariadb-gssapi-serverUpgrade galera-debuginfo | Dec 21, 2020 | Dec 15, 2020 |
| Rocky_linux | — | Upgrade Judy-debuginfoUpgrade Judy-debugsourceUpgrade Judy | Mar 12, 2024 | May 27, 2021 |
| Suse | — | Upgrade libmariadb3-32bitUpgrade mariadb-galeraUpgrade libmariadbprivateUpgrade libmariadb-develUpgrade mariadb-rpm-macrosUpgrade libmysqld-develUpgrade libmariadb3Upgrade mariadb-benchUpgrade mariadb-toolsUpgrade libmysqld19Upgrade mariadb-testUpgrade libmariadbd19Upgrade libmariadbd-develUpgrade libmariadb_pluginsUpgrade mariadb-clientUpgrade mariadbUpgrade mariadb-errormessages | Nov 25, 2020 | Oct 7, 2020 |
| Ubuntu | — | Upgrade mariadb-server | Oct 28, 2020 | Oct 7, 2020 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub