A flaw was found in the mysql-wsrep component of mariadb. Lack of input sanitization in `wsrep_sst_method` allows for command injection that can be exploited by a remote attacker to execute arbitrary commands on galera cluster nodes. This threatens the system's confidentiality, integrity, and availability. This flaw affects mariadb versions before 10.1.47, before 10.2.34, before 10.3.25, before 10.4.15 and before 10.5.6.
CVSS Details
- CVSS 3.1 Base Score: 9
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade Judy | May 4, 2022 | May 27, 2021 |
| Alpine Linux | — | Upgrade mariadb | Aug 22, 2024 | May 27, 2021 |
| Centos_linux | — | Upgrade galera-debugsourceUpgrade Judy-debuginfoUpgrade mariadb-serverUpgrade mariadb-develUpgrade mariadb-gssapi-server-debuginfoUpgrade mariadb-server-utils-debuginfoUpgrade galeraUpgrade mariadb-debugsourceUpgrade mariadb-embeddedUpgrade mariadb-backup-debuginfoUpgrade mariadb-server-debuginfoUpgrade mariadb-test-debuginfoUpgrade mariadb-server-galeraUpgrade mariadbUpgrade mariadb-server-utilsUpgrade mariadb-debuginfoUpgrade mariadb-gssapi-serverUpgrade mariadb-oqgraph-engineUpgrade Judy-debugsourceUpgrade JudyUpgrade galera-debuginfoUpgrade mariadb-embedded-debuginfoUpgrade mariadb-testUpgrade mariadb-backupUpgrade mariadb-oqgraph-engine-debuginfoUpgrade mariadb-errmsgUpgrade mariadb-embedded-develUpgrade mariadb-common | Dec 21, 2020 | Dec 15, 2020 |
| Debian | — | Upgrade mariadb-10.5 | Oct 22, 2020 | Oct 22, 2020 |
| Freebsd | — | Upgrade mariadb105-clientUpgrade mariadb103-serverUpgrade mariadb103-clientUpgrade mariadb104-serverUpgrade mariadb104-clientUpgrade mariadb105-server | Oct 19, 2020 | Oct 18, 2020 |
| Gentoo Linux | — | Upgrade dev-db/mariadb. | Nov 12, 2020 | Nov 11, 2020 |
| Mariadb Mariadb | — | Upgrade MariaDB to the latest version | Mar 4, 2025 | May 27, 2021 |
| Oracle_linux | — | Upgrade mariadb-gssapi-serverUpgrade mariadb-server-utilsUpgrade Judy-develUpgrade mariadbUpgrade mariadb-errmsgUpgrade mariadb-server-galeraUpgrade mariadb-embeddedUpgrade asio-develUpgrade JudyUpgrade mariadb-backupUpgrade mariadb-commonUpgrade mariadb-serverUpgrade mariadb-testUpgrade galeraUpgrade mariadb-develUpgrade mariadb-oqgraph-engineUpgrade mariadb-embedded-devel | Dec 18, 2020 | Oct 6, 2020 |
| Redhat_linux | — | Upgrade mariadbUpgrade mariadb-debugsourceUpgrade mariadb-commonUpgrade mariadb-testUpgrade JudyUpgrade mariadb-gssapi-serverUpgrade mariadb-gssapi-server-debuginfoUpgrade mariadb-embedded-debuginfoUpgrade galera-debuginfoUpgrade Judy-debugsourceUpgrade mariadb-oqgraph-engine-debuginfoUpgrade mariadb-backup-debuginfoUpgrade galera-debugsourceUpgrade mariadb-server-debuginfoUpgrade mariadb-test-debuginfoUpgrade mariadb-backupUpgrade mariadb-embeddedUpgrade mariadb-serverUpgrade galeraUpgrade mariadb-embedded-develUpgrade mariadb-debuginfoUpgrade mariadb-develUpgrade mariadb-server-utilsUpgrade mariadb-oqgraph-engineUpgrade Judy-debuginfoUpgrade mariadb-errmsgUpgrade mariadb-server-utils-debuginfoUpgrade mariadb-server-galera | Dec 21, 2020 | Dec 15, 2020 |
| Rocky_linux | — | Upgrade Judy-debuginfoUpgrade Judy-debugsourceUpgrade Judy | Mar 12, 2024 | May 27, 2021 |
| Suse | — | Upgrade libmariadb-develUpgrade libmysqld-develUpgrade libmariadbprivateUpgrade mariadb-galeraUpgrade mariadb-benchUpgrade libmariadb3-32bitUpgrade libmariadb3Upgrade mariadb-rpm-macrosUpgrade mariadb-testUpgrade libmysqld19Upgrade mariadbUpgrade mariadb-errormessagesUpgrade libmariadbd19Upgrade mariadb-toolsUpgrade mariadb-clientUpgrade libmariadb_pluginsUpgrade libmariadbd-devel | Nov 25, 2020 | Oct 7, 2020 |
| Ubuntu | — | Upgrade mariadb-server | Oct 28, 2020 | Oct 7, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub