A flaw was found in the mysql-wsrep component of mariadb. Lack of input sanitization in `wsrep_sst_method` allows for command injection that can be exploited by a remote attacker to execute arbitrary commands on galera cluster nodes. This threatens the system's confidentiality, integrity, and availability. This flaw affects mariadb versions before 10.1.47, before 10.2.34, before 10.3.25, before 10.4.15 and before 10.5.6.
CVSS Details
- CVSS 3.1 Base Score: 9
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade Judy | May 4, 2022 | May 27, 2021 |
| Alpine Linux | — | Upgrade mariadb | Aug 22, 2024 | May 27, 2021 |
| Centos_linux | — | Upgrade Judy-debuginfoUpgrade galera-debugsourceUpgrade mariadb-gssapi-server-debuginfoUpgrade mariadb-server-utils-debuginfoUpgrade mariadb-debuginfoUpgrade mariadb-embeddedUpgrade mariadbUpgrade mariadb-server-utilsUpgrade mariadb-test-debuginfoUpgrade mariadb-oqgraph-engineUpgrade mariadb-serverUpgrade mariadb-develUpgrade mariadb-gssapi-serverUpgrade mariadb-backup-debuginfoUpgrade mariadb-debugsourceUpgrade galeraUpgrade mariadb-server-debuginfoUpgrade mariadb-server-galeraUpgrade mariadb-embedded-debuginfoUpgrade Judy-debugsourceUpgrade mariadb-backupUpgrade JudyUpgrade mariadb-errmsgUpgrade mariadb-oqgraph-engine-debuginfoUpgrade galera-debuginfoUpgrade mariadb-commonUpgrade mariadb-embedded-develUpgrade mariadb-test | Dec 21, 2020 | Dec 15, 2020 |
| Debian | — | Upgrade mariadb-10.5 | Oct 22, 2020 | Oct 22, 2020 |
| Freebsd | — | Upgrade mariadb104-clientUpgrade mariadb103-clientUpgrade mariadb105-clientUpgrade mariadb104-serverUpgrade mariadb105-server | Oct 19, 2020 | Oct 18, 2020 |
| Gentoo Linux | — | Upgrade dev-db/mariadb. | Nov 12, 2020 | Nov 11, 2020 |
| Mariadb Mariadb | — | Upgrade MariaDB to the latest version | Mar 4, 2025 | May 27, 2021 |
| Oracle_linux | — | Upgrade mariadb-gssapi-serverUpgrade mariadb-errmsgUpgrade mariadb-server-galeraUpgrade Judy-develUpgrade JudyUpgrade mariadbUpgrade mariadb-server-utilsUpgrade mariadb-embeddedUpgrade asio-develUpgrade mariadb-commonUpgrade mariadb-oqgraph-engineUpgrade mariadb-testUpgrade mariadb-embedded-develUpgrade mariadb-serverUpgrade mariadb-backupUpgrade mariadb-develUpgrade galera | Dec 18, 2020 | Oct 6, 2020 |
| Redhat_linux | — | Upgrade mariadb-serverUpgrade mariadb-debuginfoUpgrade mariadb-server-utilsUpgrade mariadb-develUpgrade mariadb-embeddedUpgrade galera-debugsourceUpgrade mariadb-server-galeraUpgrade galeraUpgrade mariadb-embedded-develUpgrade mariadb-server-utils-debuginfoUpgrade mariadb-test-debuginfoUpgrade mariadb-backupUpgrade Judy-debuginfoUpgrade mariadb-server-debuginfoUpgrade mariadb-oqgraph-engineUpgrade mariadb-errmsgUpgrade mariadb-gssapi-server-debuginfoUpgrade mariadb-oqgraph-engine-debuginfoUpgrade mariadb-testUpgrade mariadb-gssapi-serverUpgrade Judy-debugsourceUpgrade mariadbUpgrade mariadb-debugsourceUpgrade galera-debuginfoUpgrade mariadb-commonUpgrade mariadb-backup-debuginfoUpgrade JudyUpgrade mariadb-embedded-debuginfo | Dec 21, 2020 | Dec 15, 2020 |
| Rocky_linux | — | Upgrade JudyUpgrade Judy-debugsourceUpgrade Judy-debuginfo | Mar 12, 2024 | May 27, 2021 |
| Suse | — | Upgrade mariadb-testUpgrade libmysqld19Upgrade libmariadbd-develUpgrade mariadbUpgrade mariadb-errormessagesUpgrade mariadb-toolsUpgrade libmariadb_pluginsUpgrade mariadb-clientUpgrade libmariadbd19Upgrade libmariadb-develUpgrade libmariadb3Upgrade libmariadbprivateUpgrade mariadb-rpm-macrosUpgrade mariadb-benchUpgrade mariadb-galeraUpgrade libmariadb3-32bitUpgrade libmysqld-devel | Nov 25, 2020 | Oct 7, 2020 |
| Ubuntu | — | Upgrade mariadb-server | Oct 28, 2020 | Oct 7, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub