Bug 1217405 - VUL-0: CVE-2023-22084: mariadb, mariadb-100: vulnerability allows high privileged attacker with network access via multiple protocols to compromise the server
Summary: VUL-0: CVE-2023-22084: mariadb, mariadb-100: vulnerability allows high privil...
Status: NEW
Alias: None
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/382201/
Whiteboard: CVSSv3.1:SUSE:CVE-2023-22084:4.9:(AV:...
Keywords:
Depends on:
Blocks:
 
Reported: 2023-11-22 13:49 UTC by Alexander Bergmann
Modified: 2024-06-11 12:30 UTC (History)
1 user (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Alexander Bergmann 2023-11-22 13:49:16 UTC 
Description

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.43 and prior, 8.0.34 and prior and 8.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. 

CVSS 3.1 Base Score 4.9 (Availability impacts). 
CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

References:
https://mariadb.com/kb/en/mariadb-10-4-32-release-notes/
https://nvd.nist.gov/vuln/detail/CVE-2023-22084
Comment 3 Maintenance Automation 2023-12-20 08:36:18 UTC 
SUSE-SU-2023:4908-1: An update that solves one vulnerability can now be installed.

Category: security (moderate)
Bug References: 1217405
CVE References: CVE-2023-22084
Sources used:
SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (src): mariadb-10.4.32-150200.3.48.1
SUSE Linux Enterprise Server for SAP Applications 15 SP2 (src): mariadb-10.4.32-150200.3.48.1
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (src): mariadb-10.4.32-150200.3.48.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 4 Maintenance Automation 2023-12-20 08:36:20 UTC 
SUSE-SU-2023:4907-1: An update that solves one vulnerability can now be installed.

Category: security (moderate)
Bug References: 1217405
CVE References: CVE-2023-22084
Sources used:
openSUSE Leap 15.3 (src): mariadb-10.5.23-150300.3.38.1
SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 (src): mariadb-10.5.23-150300.3.38.1
SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (src): mariadb-10.5.23-150300.3.38.1
Galera for Ericsson 15 SP3 (src): mariadb-10.5.23-150300.3.38.1
SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (src): mariadb-10.5.23-150300.3.38.1
SUSE Linux Enterprise Server for SAP Applications 15 SP3 (src): mariadb-10.5.23-150300.3.38.1
SUSE Enterprise Storage 7.1 (src): mariadb-10.5.23-150300.3.38.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 9 Maintenance Automation 2024-06-04 12:30:04 UTC 
SUSE-SU-2024:1922-1: An update that solves one vulnerability can now be installed.

Category: security (moderate)
Bug References: 1217405
CVE References: CVE-2023-22084
Maintenance Incident: [SUSE:Maintenance:34124](https://smelt.suse.de/incident/34124/)
Sources used:
openSUSE Leap 15.6 (src):
 mariadb104-10.4.33-150100.3.8.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 11 Maintenance Automation 2024-06-11 12:30:17 UTC 
SUSE-SU-2024:1985-1: An update that solves two vulnerabilities can now be installed.

Category: security (moderate)
Bug References: 1217405, 1225983
CVE References: CVE-2023-22084, CVE-2024-21096
Maintenance Incident: [SUSE:Maintenance:34175](https://smelt.suse.de/incident/34175/)
Sources used:
openSUSE Leap 15.4 (src):
 mariadb-10.6.18-150400.3.33.1
openSUSE Leap 15.5 (src):
 mariadb-10.6.18-150400.3.33.1
SUSE Package Hub 15 15-SP5 (src):
 mariadb-10.6.18-150400.3.33.1
Server Applications Module 15-SP5 (src):
 mariadb-10.6.18-150400.3.33.1
SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (src):
 mariadb-10.6.18-150400.3.33.1
SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (src):
 mariadb-10.6.18-150400.3.33.1
Galera for Ericsson 15 SP4 (src):
 mariadb-10.6.18-150400.3.33.1
SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (src):
 mariadb-10.6.18-150400.3.33.1
Galera for Ericsson 15 SP5 (src):
 mariadb-10.6.18-150400.3.33.1
SUSE Linux Enterprise Server for SAP Applications 15 SP4 (src):
 mariadb-10.6.18-150400.3.33.1
SUSE Manager Proxy 4.3 (src):
 mariadb-10.6.18-150400.3.33.1
SUSE Manager Retail Branch Server 4.3 (src):
 mariadb-10.6.18-150400.3.33.1
SUSE Manager Server 4.3 (src):
 mariadb-10.6.18-150400.3.33.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.