A flaw was found in the mysql-wsrep component of mariadb. Lack of input sanitization in `wsrep_sst_method` allows for command injection that can be exploited by a remote attacker to execute arbitrary commands on galera cluster nodes. This threatens the system's confidentiality, integrity, and availability. This flaw affects mariadb versions before 10.1.47, before 10.2.34, before 10.3.25, before 10.4.15 and before 10.5.6.
CVSS Details
- CVSS 3.1 Base Score: 9
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade Judy | May 4, 2022 | May 27, 2021 |
| Alpine Linux | — | Upgrade mariadb | Aug 22, 2024 | May 27, 2021 |
| Centos_linux | — | Upgrade mariadb-commonUpgrade mariadb-errmsgUpgrade mariadb-oqgraph-engine-debuginfoUpgrade mariadb-embedded-debuginfoUpgrade mariadb-testUpgrade Judy-debugsourceUpgrade mariadb-embedded-develUpgrade JudyUpgrade galera-debuginfoUpgrade mariadb-backupUpgrade mariadb-gssapi-server-debuginfoUpgrade galeraUpgrade Judy-debuginfoUpgrade mariadb-server-utils-debuginfoUpgrade galera-debugsourceUpgrade mariadb-debugsourceUpgrade mariadb-backup-debuginfoUpgrade mariadb-debuginfoUpgrade mariadb-server-galeraUpgrade mariadb-serverUpgrade mariadb-develUpgrade mariadb-server-utilsUpgrade mariadb-server-debuginfoUpgrade mariadb-embeddedUpgrade mariadb-test-debuginfoUpgrade mariadbUpgrade mariadb-oqgraph-engineUpgrade mariadb-gssapi-server | Dec 21, 2020 | Dec 15, 2020 |
| Debian | — | Upgrade mariadb-10.5 | Oct 22, 2020 | Oct 22, 2020 |
| Freebsd | — | Upgrade mariadb105-clientUpgrade mariadb104-serverUpgrade mariadb103-clientUpgrade mariadb103-serverUpgrade mariadb105-serverUpgrade mariadb104-client | Oct 19, 2020 | Oct 18, 2020 |
| Gentoo Linux | — | Upgrade dev-db/mariadb. | Nov 12, 2020 | Nov 11, 2020 |
| Mariadb Mariadb | — | Upgrade MariaDB to the latest version | Mar 4, 2025 | May 27, 2021 |
| Oracle_linux | — | Upgrade mariadb-gssapi-serverUpgrade asio-develUpgrade mariadbUpgrade Judy-develUpgrade mariadb-embeddedUpgrade mariadb-server-utilsUpgrade mariadb-server-galeraUpgrade JudyUpgrade mariadb-errmsgUpgrade mariadb-serverUpgrade mariadb-develUpgrade mariadb-commonUpgrade mariadb-oqgraph-engineUpgrade mariadb-embedded-develUpgrade mariadb-backupUpgrade mariadb-testUpgrade galera | Dec 18, 2020 | Oct 6, 2020 |
| Redhat_linux | — | Upgrade mariadb-embedded-debuginfoUpgrade mariadb-gssapi-serverUpgrade mariadb-gssapi-server-debuginfoUpgrade mariadb-commonUpgrade galera-debuginfoUpgrade Judy-debugsourceUpgrade mariadb-debugsourceUpgrade JudyUpgrade mariadb-testUpgrade mariadb-oqgraph-engine-debuginfoUpgrade mariadbUpgrade mariadb-backup-debuginfoUpgrade Judy-debuginfoUpgrade mariadb-server-utilsUpgrade galeraUpgrade mariadb-backupUpgrade mariadb-test-debuginfoUpgrade mariadb-errmsgUpgrade mariadb-server-debuginfoUpgrade mariadb-server-utils-debuginfoUpgrade mariadb-server-galeraUpgrade galera-debugsourceUpgrade mariadb-serverUpgrade mariadb-embeddedUpgrade mariadb-develUpgrade mariadb-oqgraph-engineUpgrade mariadb-embedded-develUpgrade mariadb-debuginfo | Dec 21, 2020 | Dec 15, 2020 |
| Rocky_linux | — | Upgrade Judy-debuginfoUpgrade Judy-debugsourceUpgrade Judy | Mar 12, 2024 | May 27, 2021 |
| Suse | — | Upgrade libmariadb_pluginsUpgrade mariadb-clientUpgrade mariadb-testUpgrade mariadbUpgrade mariadb-errormessagesUpgrade libmariadbd19Upgrade libmariadbd-develUpgrade mariadb-toolsUpgrade libmysqld19Upgrade libmariadb3-32bitUpgrade libmariadbprivateUpgrade libmariadb-develUpgrade libmysqld-develUpgrade mariadb-galeraUpgrade mariadb-rpm-macrosUpgrade libmariadb3Upgrade mariadb-bench | Nov 25, 2020 | Oct 7, 2020 |
| Ubuntu | — | Upgrade mariadb-server | Oct 28, 2020 | Oct 7, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub