A flaw was found in the mysql-wsrep component of mariadb. Lack of input sanitization in `wsrep_sst_method` allows for command injection that can be exploited by a remote attacker to execute arbitrary commands on galera cluster nodes. This threatens the system's confidentiality, integrity, and availability. This flaw affects mariadb versions before 10.1.47, before 10.2.34, before 10.3.25, before 10.4.15 and before 10.5.6.
CVSS Details
- CVSS 3.1 Base Score: 9
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade Judy | May 4, 2022 | May 27, 2021 |
| Alpine Linux | — | Upgrade mariadb | Aug 22, 2024 | May 27, 2021 |
| Centos_linux | — | Upgrade mariadb-errmsgUpgrade mariadb-embedded-debuginfoUpgrade mariadb-testUpgrade mariadb-oqgraph-engine-debuginfoUpgrade galera-debuginfoUpgrade mariadb-commonUpgrade mariadb-backupUpgrade mariadb-embedded-develUpgrade JudyUpgrade Judy-debugsourceUpgrade mariadb-gssapi-server-debuginfoUpgrade mariadb-server-utils-debuginfoUpgrade Judy-debuginfoUpgrade galera-debugsourceUpgrade mariadbUpgrade mariadb-oqgraph-engineUpgrade mariadb-gssapi-serverUpgrade mariadb-test-debuginfoUpgrade mariadb-embeddedUpgrade mariadb-backup-debuginfoUpgrade mariadb-debugsourceUpgrade galeraUpgrade mariadb-serverUpgrade mariadb-develUpgrade mariadb-server-utilsUpgrade mariadb-server-debuginfoUpgrade mariadb-server-galeraUpgrade mariadb-debuginfo | Dec 21, 2020 | Dec 15, 2020 |
| Debian | — | Upgrade mariadb-10.5 | Oct 22, 2020 | Oct 22, 2020 |
| Freebsd | — | Upgrade mariadb105-serverUpgrade mariadb104-clientUpgrade mariadb103-clientUpgrade mariadb103-serverUpgrade mariadb105-clientUpgrade mariadb104-server | Oct 19, 2020 | Oct 18, 2020 |
| Gentoo Linux | — | Upgrade dev-db/mariadb. | Nov 12, 2020 | Nov 11, 2020 |
| Mariadb Mariadb | — | Upgrade MariaDB to the latest version | Mar 4, 2025 | May 27, 2021 |
| Oracle_linux | — | Upgrade mariadb-commonUpgrade mariadb-develUpgrade galeraUpgrade mariadb-serverUpgrade mariadb-embedded-develUpgrade mariadb-testUpgrade mariadb-oqgraph-engineUpgrade mariadb-backupUpgrade mariadb-errmsgUpgrade Judy-develUpgrade asio-develUpgrade mariadb-server-utilsUpgrade mariadb-embeddedUpgrade mariadb-gssapi-serverUpgrade mariadbUpgrade JudyUpgrade mariadb-server-galera | Dec 18, 2020 | Oct 6, 2020 |
| Redhat_linux | — | Upgrade galera-debugsourceUpgrade mariadb-develUpgrade mariadb-test-debuginfoUpgrade mariadb-errmsgUpgrade Judy-debuginfoUpgrade mariadb-server-galeraUpgrade mariadb-server-debuginfoUpgrade mariadb-server-utils-debuginfoUpgrade galeraUpgrade mariadb-embedded-develUpgrade mariadb-oqgraph-engineUpgrade mariadb-serverUpgrade mariadb-debuginfoUpgrade mariadb-server-utilsUpgrade mariadb-embeddedUpgrade mariadb-backupUpgrade mariadb-gssapi-server-debuginfoUpgrade mariadb-gssapi-serverUpgrade mariadbUpgrade mariadb-commonUpgrade JudyUpgrade mariadb-embedded-debuginfoUpgrade mariadb-testUpgrade mariadb-debugsourceUpgrade mariadb-oqgraph-engine-debuginfoUpgrade Judy-debugsourceUpgrade mariadb-backup-debuginfoUpgrade galera-debuginfo | Dec 21, 2020 | Dec 15, 2020 |
| Rocky_linux | — | Upgrade JudyUpgrade Judy-debugsourceUpgrade Judy-debuginfo | Mar 12, 2024 | May 27, 2021 |
| Suse | — | Upgrade mariadb-benchUpgrade libmariadb3Upgrade libmysqld-develUpgrade mariadb-rpm-macrosUpgrade libmariadb3-32bitUpgrade libmariadbprivateUpgrade mariadb-galeraUpgrade libmariadb-develUpgrade mariadb-clientUpgrade libmariadbd19Upgrade mariadb-errormessagesUpgrade mariadbUpgrade mariadb-testUpgrade libmysqld19Upgrade mariadb-toolsUpgrade libmariadb_pluginsUpgrade libmariadbd-devel | Nov 25, 2020 | Oct 7, 2020 |
| Ubuntu | — | Upgrade mariadb-server | Oct 28, 2020 | Oct 7, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub