-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: rh-mariadb103-galera and rh-mariadb103-mariadb security and bug fix update Advisory ID: RHSA-2022:6306-01 Product: Red Hat Software Collections Advisory URL: https://access.redhat.com/errata/RHSA-2022:6306 Issue date: 2022-09-01 CVE Names: CVE-2021-46659 CVE-2021-46661 CVE-2021-46663 CVE-2021-46664 CVE-2021-46665 CVE-2021-46668 CVE-2021-46669 CVE-2022-21427 CVE-2022-24048 CVE-2022-24050 CVE-2022-24051 CVE-2022-24052 CVE-2022-27376 CVE-2022-27377 CVE-2022-27378 CVE-2022-27379 CVE-2022-27380 CVE-2022-27381 CVE-2022-27383 CVE-2022-27384 CVE-2022-27386 CVE-2022-27387 CVE-2022-27445 CVE-2022-27447 CVE-2022-27448 CVE-2022-27449 CVE-2022-27452 CVE-2022-27456 CVE-2022-27458 CVE-2022-31622 CVE-2022-31623 CVE-2022-32083 CVE-2022-32085 CVE-2022-32087 CVE-2022-32088 ==================================================================== 1. Summary: An update for rh-mariadb103-galera and rh-mariadb103-mariadb is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) - ppc64le, s390x, x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) - x86_64 3. Description: MariaDB is a multi-user, multi-threaded SQL database server. For all practical purposes, MariaDB is binary-compatible with MySQL. The following packages have been upgraded to a later upstream version: rh-mariadb103-galera (25.3.35), rh-mariadb103-mariadb (10.3.35). Security Fix(es): * mariadb: MariaDB through 10.5.9 allows attackers to trigger a convert_const_to_int use-after-free when the BIGINT data type is used (CVE-2021-46669) * mysql: Server: FTS unspecified vulnerability (CPU Apr 2022) (CVE-2022-21427) * mariadb: lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer (CVE-2022-24048) * mariadb: lack of validating the existence of an object prior to performing operations on the object (CVE-2022-24050) * mariadb: lack of proper validation of a user-supplied string before using it as a format specifier (CVE-2022-24051) * mariadb: CONNECT storage engine heap-based buffer overflow (CVE-2022-24052) * mariadb: assertion failure in Item_args::walk_arg (CVE-2022-27376) * mariadb: use-after-poison when complex conversion is involved in blob (CVE-2022-27377) * mariadb: server crash in create_tmp_table::finalize (CVE-2022-27378) * mariadb: server crash in component arg_comparator::compare_real_fixed (CVE-2022-27379) * mariadb: server crash at my_decimal::operator= (CVE-2022-27380) * mariadb: server crash at Field::set_default via specially crafted SQL statements (CVE-2022-27381) * mariadb: use-after-poison in my_strcasecmp_8bit() of ctype-simple.c (CVE-2022-27383) * mariadb: crash via component Item_subselect::init_expr_cache_tracker (CVE-2022-27384) * mariadb: server crashes in query_arena::set_query_arena upon SELECT from view (CVE-2022-27386) * mariadb: assertion failures in decimal_bin_size (CVE-2022-27387) * mariadb: assertion failure in compare_order_elements (CVE-2022-27445) * mariadb: use-after-poison in Binary_string::free_buffer (CVE-2022-27447) * mariadb: crash in multi-update and implicit grouping (CVE-2022-27448) * mariadb: assertion failure in sql/item_func.cc (CVE-2022-27449) * mariadb: assertion failure in sql/item_cmpfunc.cc (CVE-2022-27452) * mariadb: assertion failure in VDec::VDec at /sql/sql_type.cc (CVE-2022-27456) * mariadb: use-after-poison in Binary_string::free_buffer (CVE-2022-27458) * mariadb: improper locking due to the unreleased lock in extra/mariabackup/ds_compress.cc (CVE-2022-31622) * mariadb: improper locking due to the unreleased lock in extra/mariabackup/ds_compress.cc (CVE-2022-31623) * mariadb: server crash at Item_subselect::init_expr_cache_tracker (CVE-2022-32083) * mariadb: server crash in Item_func_in::cleanup/Item::cleanup_processor (CVE-2022-32085) * mariadb: server crash in Item_args::walk_args (CVE-2022-32087) * mariadb: segmentation fault in Exec_time_tracker::get_loops/Filesort_tracker::report_use/filesort (CVE-2022-32088) * mariadb: Crash executing query with VIEW, aggregate and subquery (CVE-2021-46659) * mariadb: MariaDB allows an application crash in find_field_in_tables and find_order_in_list via an unused common table expression (CTE) (CVE-2021-46661) * mariadb: MariaDB through 10.5.13 allows a ha_maria::extra application crash via certain SELECT statements (CVE-2021-46663) * mariadb: MariaDB through 10.5.9 allows an application crash in sub_select_postjoin_aggr for a NULL value of aggr (CVE-2021-46664) * mariadb: MariaDB through 10.5.9 allows a sql_parse.cc application crash because of incorrect used_tables expectations (CVE-2021-46665) * mariadb: MariaDB through 10.5.9 allows an application crash via certain long SELECT DISTINCT statements (CVE-2021-46668) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * [Tracker] Rebase to Galera 25.3.35 for MariaDB-10.3 (BZ#2107054) 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the MariaDB server daemon (mysqld) will be restarted automatically. 5. Bugs fixed (https://bugzilla.redhat.com/): 2049302 - CVE-2021-46659 mariadb: Crash executing query with VIEW, aggregate and subquery 2050017 - CVE-2021-46661 mariadb: MariaDB allows an application crash in find_field_in_tables and find_order_in_list via an unused common table expression (CTE) 2050022 - CVE-2021-46663 mariadb: MariaDB through 10.5.13 allows a ha_maria::extra application crash via certain SELECT statements 2050024 - CVE-2021-46664 mariadb: MariaDB through 10.5.9 allows an application crash in sub_select_postjoin_aggr for a NULL value of aggr 2050026 - CVE-2021-46665 mariadb: MariaDB through 10.5.9 allows a sql_parse.cc application crash because of incorrect used_tables expectations 2050032 - CVE-2021-46668 mariadb: MariaDB through 10.5.9 allows an application crash via certain long SELECT DISTINCT statements 2050034 - CVE-2021-46669 mariadb: MariaDB through 10.5.9 allows attackers to trigger a convert_const_to_int use-after-free when the BIGINT data type is used 2068211 - CVE-2022-24052 mariadb: CONNECT storage engine heap-based buffer overflow 2068233 - CVE-2022-24051 mariadb: lack of proper validation of a user-supplied string before using it as a format specifier 2068234 - CVE-2022-24048 mariadb: lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer 2069833 - CVE-2022-24050 mariadb: lack of validating the existence of an object prior to performing operations on the object 2074817 - CVE-2022-27376 mariadb: assertion failure in Item_args::walk_arg 2074947 - CVE-2022-27377 mariadb: use-after-poison when complex conversion is involved in blob 2074949 - CVE-2022-27378 mariadb: server crash in create_tmp_table::finalize 2074951 - CVE-2022-27379 mariadb: server crash in component arg_comparator::compare_real_fixed 2074966 - CVE-2022-27380 mariadb: server crash at my_decimal::operator2074981 - CVE-2022-27381 mariadb: server crash at Field::set_default via specially crafted SQL statements 2074996 - CVE-2022-27383 mariadb: use-after-poison in my_strcasecmp_8bit() of ctype-simple.c 2074999 - CVE-2022-27384 mariadb: crash via component Item_subselect::init_expr_cache_tracker 2075005 - CVE-2022-27386 mariadb: server crashes in query_arena::set_query_arena upon SELECT from view 2075006 - CVE-2022-27387 mariadb: assertion failures in decimal_bin_size 2075691 - CVE-2022-27445 mariadb: assertion failure in compare_order_elements 2075693 - CVE-2022-27447 mariadb: use-after-poison in Binary_string::free_buffer 2075694 - CVE-2022-27448 mariadb: crash in multi-update and implicit grouping 2075695 - CVE-2022-27449 mariadb: assertion failure in sql/item_func.cc 2075697 - CVE-2022-27456 mariadb: assertion failure in VDec::VDec at /sql/sql_type.cc 2075700 - CVE-2022-27458 mariadb: use-after-poison in Binary_string::free_buffer 2076145 - CVE-2022-27452 mariadb: assertion failure in sql/item_cmpfunc.cc 2082644 - CVE-2022-21427 mysql: Server: FTS unspecified vulnerability (CPU Apr 2022) 2092354 - CVE-2022-31622 mariadb: improper locking due to the unreleased lock in extra/mariabackup/ds_compress.cc 2092360 - CVE-2022-31623 mariadb: improper locking due to the unreleased lock in extra/mariabackup/ds_compress.cc 2104425 - CVE-2022-32083 mariadb: server crash at Item_subselect::init_expr_cache_tracker 2104431 - CVE-2022-32085 mariadb: server crash in Item_func_in::cleanup/Item::cleanup_processor 2104434 - CVE-2022-32087 mariadb: server crash in Item_args::walk_args 2106008 - CVE-2022-32088 mariadb: segmentation fault in Exec_time_tracker::get_loops/Filesort_tracker::report_use/filesort 6. Package List: Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7): Source: rh-mariadb103-galera-25.3.35-1.el7.src.rpm rh-mariadb103-mariadb-10.3.35-1.el7.src.rpm ppc64le: rh-mariadb103-galera-25.3.35-1.el7.ppc64le.rpm rh-mariadb103-galera-debuginfo-25.3.35-1.el7.ppc64le.rpm rh-mariadb103-mariadb-10.3.35-1.el7.ppc64le.rpm rh-mariadb103-mariadb-backup-10.3.35-1.el7.ppc64le.rpm rh-mariadb103-mariadb-backup-syspaths-10.3.35-1.el7.ppc64le.rpm rh-mariadb103-mariadb-common-10.3.35-1.el7.ppc64le.rpm rh-mariadb103-mariadb-config-10.3.35-1.el7.ppc64le.rpm rh-mariadb103-mariadb-config-syspaths-10.3.35-1.el7.ppc64le.rpm rh-mariadb103-mariadb-connect-engine-10.3.35-1.el7.ppc64le.rpm rh-mariadb103-mariadb-debuginfo-10.3.35-1.el7.ppc64le.rpm rh-mariadb103-mariadb-devel-10.3.35-1.el7.ppc64le.rpm rh-mariadb103-mariadb-errmsg-10.3.35-1.el7.ppc64le.rpm rh-mariadb103-mariadb-gssapi-server-10.3.35-1.el7.ppc64le.rpm rh-mariadb103-mariadb-oqgraph-engine-10.3.35-1.el7.ppc64le.rpm rh-mariadb103-mariadb-server-10.3.35-1.el7.ppc64le.rpm rh-mariadb103-mariadb-server-galera-10.3.35-1.el7.ppc64le.rpm rh-mariadb103-mariadb-server-galera-syspaths-10.3.35-1.el7.ppc64le.rpm rh-mariadb103-mariadb-server-syspaths-10.3.35-1.el7.ppc64le.rpm rh-mariadb103-mariadb-server-utils-10.3.35-1.el7.ppc64le.rpm rh-mariadb103-mariadb-server-utils-syspaths-10.3.35-1.el7.ppc64le.rpm rh-mariadb103-mariadb-syspaths-10.3.35-1.el7.ppc64le.rpm rh-mariadb103-mariadb-test-10.3.35-1.el7.ppc64le.rpm s390x: rh-mariadb103-galera-25.3.35-1.el7.s390x.rpm rh-mariadb103-galera-debuginfo-25.3.35-1.el7.s390x.rpm rh-mariadb103-mariadb-10.3.35-1.el7.s390x.rpm rh-mariadb103-mariadb-backup-10.3.35-1.el7.s390x.rpm rh-mariadb103-mariadb-backup-syspaths-10.3.35-1.el7.s390x.rpm rh-mariadb103-mariadb-common-10.3.35-1.el7.s390x.rpm rh-mariadb103-mariadb-config-10.3.35-1.el7.s390x.rpm rh-mariadb103-mariadb-config-syspaths-10.3.35-1.el7.s390x.rpm rh-mariadb103-mariadb-connect-engine-10.3.35-1.el7.s390x.rpm rh-mariadb103-mariadb-debuginfo-10.3.35-1.el7.s390x.rpm rh-mariadb103-mariadb-devel-10.3.35-1.el7.s390x.rpm rh-mariadb103-mariadb-errmsg-10.3.35-1.el7.s390x.rpm rh-mariadb103-mariadb-gssapi-server-10.3.35-1.el7.s390x.rpm rh-mariadb103-mariadb-oqgraph-engine-10.3.35-1.el7.s390x.rpm rh-mariadb103-mariadb-server-10.3.35-1.el7.s390x.rpm rh-mariadb103-mariadb-server-galera-10.3.35-1.el7.s390x.rpm rh-mariadb103-mariadb-server-galera-syspaths-10.3.35-1.el7.s390x.rpm rh-mariadb103-mariadb-server-syspaths-10.3.35-1.el7.s390x.rpm rh-mariadb103-mariadb-server-utils-10.3.35-1.el7.s390x.rpm rh-mariadb103-mariadb-server-utils-syspaths-10.3.35-1.el7.s390x.rpm rh-mariadb103-mariadb-syspaths-10.3.35-1.el7.s390x.rpm rh-mariadb103-mariadb-test-10.3.35-1.el7.s390x.rpm x86_64: rh-mariadb103-galera-25.3.35-1.el7.x86_64.rpm rh-mariadb103-galera-debuginfo-25.3.35-1.el7.x86_64.rpm rh-mariadb103-mariadb-10.3.35-1.el7.x86_64.rpm rh-mariadb103-mariadb-backup-10.3.35-1.el7.x86_64.rpm rh-mariadb103-mariadb-backup-syspaths-10.3.35-1.el7.x86_64.rpm rh-mariadb103-mariadb-common-10.3.35-1.el7.x86_64.rpm rh-mariadb103-mariadb-config-10.3.35-1.el7.x86_64.rpm rh-mariadb103-mariadb-config-syspaths-10.3.35-1.el7.x86_64.rpm rh-mariadb103-mariadb-connect-engine-10.3.35-1.el7.x86_64.rpm rh-mariadb103-mariadb-debuginfo-10.3.35-1.el7.x86_64.rpm rh-mariadb103-mariadb-devel-10.3.35-1.el7.x86_64.rpm rh-mariadb103-mariadb-errmsg-10.3.35-1.el7.x86_64.rpm rh-mariadb103-mariadb-gssapi-server-10.3.35-1.el7.x86_64.rpm rh-mariadb103-mariadb-oqgraph-engine-10.3.35-1.el7.x86_64.rpm rh-mariadb103-mariadb-server-10.3.35-1.el7.x86_64.rpm rh-mariadb103-mariadb-server-galera-10.3.35-1.el7.x86_64.rpm rh-mariadb103-mariadb-server-galera-syspaths-10.3.35-1.el7.x86_64.rpm rh-mariadb103-mariadb-server-syspaths-10.3.35-1.el7.x86_64.rpm rh-mariadb103-mariadb-server-utils-10.3.35-1.el7.x86_64.rpm rh-mariadb103-mariadb-server-utils-syspaths-10.3.35-1.el7.x86_64.rpm rh-mariadb103-mariadb-syspaths-10.3.35-1.el7.x86_64.rpm rh-mariadb103-mariadb-test-10.3.35-1.el7.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7): Source: rh-mariadb103-galera-25.3.35-1.el7.src.rpm rh-mariadb103-mariadb-10.3.35-1.el7.src.rpm x86_64: rh-mariadb103-galera-25.3.35-1.el7.x86_64.rpm rh-mariadb103-galera-debuginfo-25.3.35-1.el7.x86_64.rpm rh-mariadb103-mariadb-10.3.35-1.el7.x86_64.rpm rh-mariadb103-mariadb-backup-10.3.35-1.el7.x86_64.rpm rh-mariadb103-mariadb-backup-syspaths-10.3.35-1.el7.x86_64.rpm rh-mariadb103-mariadb-common-10.3.35-1.el7.x86_64.rpm rh-mariadb103-mariadb-config-10.3.35-1.el7.x86_64.rpm rh-mariadb103-mariadb-config-syspaths-10.3.35-1.el7.x86_64.rpm rh-mariadb103-mariadb-connect-engine-10.3.35-1.el7.x86_64.rpm rh-mariadb103-mariadb-debuginfo-10.3.35-1.el7.x86_64.rpm rh-mariadb103-mariadb-devel-10.3.35-1.el7.x86_64.rpm rh-mariadb103-mariadb-errmsg-10.3.35-1.el7.x86_64.rpm rh-mariadb103-mariadb-gssapi-server-10.3.35-1.el7.x86_64.rpm rh-mariadb103-mariadb-oqgraph-engine-10.3.35-1.el7.x86_64.rpm rh-mariadb103-mariadb-server-10.3.35-1.el7.x86_64.rpm rh-mariadb103-mariadb-server-galera-10.3.35-1.el7.x86_64.rpm rh-mariadb103-mariadb-server-galera-syspaths-10.3.35-1.el7.x86_64.rpm rh-mariadb103-mariadb-server-syspaths-10.3.35-1.el7.x86_64.rpm rh-mariadb103-mariadb-server-utils-10.3.35-1.el7.x86_64.rpm rh-mariadb103-mariadb-server-utils-syspaths-10.3.35-1.el7.x86_64.rpm rh-mariadb103-mariadb-syspaths-10.3.35-1.el7.x86_64.rpm rh-mariadb103-mariadb-test-10.3.35-1.el7.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2021-46659 https://access.redhat.com/security/cve/CVE-2021-46661 https://access.redhat.com/security/cve/CVE-2021-46663 https://access.redhat.com/security/cve/CVE-2021-46664 https://access.redhat.com/security/cve/CVE-2021-46665 https://access.redhat.com/security/cve/CVE-2021-46668 https://access.redhat.com/security/cve/CVE-2021-46669 https://access.redhat.com/security/cve/CVE-2022-21427 https://access.redhat.com/security/cve/CVE-2022-24048 https://access.redhat.com/security/cve/CVE-2022-24050 https://access.redhat.com/security/cve/CVE-2022-24051 https://access.redhat.com/security/cve/CVE-2022-24052 https://access.redhat.com/security/cve/CVE-2022-27376 https://access.redhat.com/security/cve/CVE-2022-27377 https://access.redhat.com/security/cve/CVE-2022-27378 https://access.redhat.com/security/cve/CVE-2022-27379 https://access.redhat.com/security/cve/CVE-2022-27380 https://access.redhat.com/security/cve/CVE-2022-27381 https://access.redhat.com/security/cve/CVE-2022-27383 https://access.redhat.com/security/cve/CVE-2022-27384 https://access.redhat.com/security/cve/CVE-2022-27386 https://access.redhat.com/security/cve/CVE-2022-27387 https://access.redhat.com/security/cve/CVE-2022-27445 https://access.redhat.com/security/cve/CVE-2022-27447 https://access.redhat.com/security/cve/CVE-2022-27448 https://access.redhat.com/security/cve/CVE-2022-27449 https://access.redhat.com/security/cve/CVE-2022-27452 https://access.redhat.com/security/cve/CVE-2022-27456 https://access.redhat.com/security/cve/CVE-2022-27458 https://access.redhat.com/security/cve/CVE-2022-31622 https://access.redhat.com/security/cve/CVE-2022-31623 https://access.redhat.com/security/cve/CVE-2022-32083 https://access.redhat.com/security/cve/CVE-2022-32085 https://access.redhat.com/security/cve/CVE-2022-32087 https://access.redhat.com/security/cve/CVE-2022-32088 https://access.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2022 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYxDdV9zjgjWX9erEAQifSA//aRBkVx5vWWSNWiR+bpq9ro9ZZgI9c1kZ CfYDwuybF1RIkEyfkEnDsc09/UzIAumlRqiAWYitb3novcS9G3+PhMI3tNK1lGXm wVEZ06kY69AxLcnHazQSh1smJlgOnA+jeBJA3qbCq9gc9d7jVQQTRmLjcQISW0Nc Jdg8klmApRdgwQKvFfINWojVwW5+XCYqzgPags5m4/jMSs+zC64l4iedHzdaK9ni UeTF41qPmeiwqKfLkaxa7TXXzYO8Nj8kveZj0F7j4ZnAums+FSVmHGNDWu42OKdk CDX4XviQt8ykGt/21WHyeFlvxtWkU2nuzPi4MP1/OF9rh5hgImgPXpY34JNjQ6Xu 2k90YSbZAkk2knsnbAdaDDoHLAMma4CYfjZL54ll9XTD2VVPfGxTeng2NBCWf17U xDqCZTVt2GdrYclmX6CE65u6b6LmO6B+ALnRbB9fFC5bFhT/t+PU4MOGBIKK1238 6vs07JOn+hkadH7Cy0RJukdcJ1IDz7/8BDXaUQNHzcn2I2cpde8luYX3SfXkQqnH N2exSc0lseD/J2gWBlxzZqjWyp6ly7byYELgByugXYuCuB2JJwQA0jPmKY5HHVxp vCmDOa7jvP81r/LfN0e0q0oM4UE9yThi1Y4mSiKW1TPpmzRwolejwkW0xUu4fQtW V6O5WEsw6KYékr -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce