CVE-2024-21013
Published: 16 April 2024
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.36 and prior and 8.3.0 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).
Notes
Author | Note |
---|---|
iconstantin |
since mysql versions 5.7 and earlier are no longer supported upstream, we are unable to update them to address security issues, marking as ignored. mariadb 5.5, 10.0, 10.1, and 10.3 are end of life and no longer supported upstream - marking as ignored. |
Priority
Status
Package | Release | Status |
---|---|---|
mariadb
Launchpad, Ubuntu, Debian |
focal |
Does not exist
|
jammy |
Does not exist
|
|
mantic |
Not vulnerable
(mysql only)
|
|
noble |
Not vulnerable
(mysql only)
|
|
upstream |
Not vulnerable
(mysql only)
|
|
mariadb-10.0
Launchpad, Ubuntu, Debian |
focal |
Does not exist
|
jammy |
Does not exist
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Not vulnerable
(mysql only)
|
|
xenial |
Not vulnerable
(mysql only)
|
|
mariadb-10.1
Launchpad, Ubuntu, Debian |
bionic |
Not vulnerable
(mysql only)
|
focal |
Does not exist
|
|
jammy |
Does not exist
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Not vulnerable
(mysql only)
|
|
mariadb-10.3
Launchpad, Ubuntu, Debian |
focal |
Ignored
(end of standard support)
|
jammy |
Does not exist
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Not vulnerable
(mysql only)
|
|
mariadb-10.6
Launchpad, Ubuntu, Debian |
focal |
Does not exist
|
jammy |
Not vulnerable
(mysql only)
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Not vulnerable
(mysql only)
|
|
mysql-5.5
Launchpad, Ubuntu, Debian |
focal |
Does not exist
|
jammy |
Does not exist
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
trusty |
Ignored
(see notes)
|
|
upstream |
Needs triage
|
|
mysql-5.7
Launchpad, Ubuntu, Debian |
bionic |
Needs triage
|
focal |
Does not exist
|
|
jammy |
Does not exist
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Needs triage
|
|
xenial |
Ignored
(see notes)
|
|
mysql-8.0
Launchpad, Ubuntu, Debian |
focal |
Released
(8.0.37-0ubuntu0.20.04.3)
|
jammy |
Released
(8.0.37-0ubuntu0.22.04.3)
|
|
mantic |
Released
(8.0.37-0ubuntu0.23.10.2)
|
|
noble |
Released
(8.0.37-0ubuntu0.24.04.1)
|
|
upstream |
Released
(8.0.37)
|
|
percona-server-5.6
Launchpad, Ubuntu, Debian |
focal |
Does not exist
|
jammy |
Does not exist
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Needs triage
|
|
xenial |
Needs triage
|
|
percona-xtradb-cluster-5.6
Launchpad, Ubuntu, Debian |
focal |
Does not exist
|
jammy |
Does not exist
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Needs triage
|
|
xenial |
Needs triage
|
Severity score breakdown
Parameter | Value |
---|---|
Base score | 4.4 |
Attack vector | Network |
Attack complexity | High |
Privileges required | High |
User interaction | None |
Scope | Unchanged |
Confidentiality | None |
Integrity impact | None |
Availability impact | High |
Vector | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H |