REDHAT-BUG-2488450: High severity MariaDB MariaDB Server vulnerability
MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shell commands on the donor side via the mariabackup SST method. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MariaDB server (mariabackup SST)to a version that resolves this vulnerability.Fixed in 10.6.26 - Upgrade
Upgrade
MariaDB server (mariabackup SST)to a version that resolves this vulnerability.Fixed in 10.11.17 - Upgrade
Upgrade
MariaDB server (mariabackup SST)to a version that resolves this vulnerability.Fixed in 11.4.11 - Upgrade
Upgrade
MariaDB server (mariabackup SST)to a version that resolves this vulnerability.Fixed in 11.8.7 - Upgrade
Upgrade
MariaDB server (mariabackup SST)to a version that resolves this vulnerability.Fixed in 12.3.2
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2488450?
The severity of REDHAT-BUG-2488450 is rated as high with a score of 7.
How do I fix REDHAT-BUG-2488450?
To fix REDHAT-BUG-2488450, upgrade MariaDB to versions 10.6.26 or later, 10.11.17 or later, 11.4.11 or later, 11.8.7 or later, or 12.3.1 or later.
What versions of MariaDB are affected by REDHAT-BUG-2488450?
REDHAT-BUG-2488450 affects MariaDB versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1.
What is the impact of REDHAT-BUG-2488450?
The impact of REDHAT-BUG-2488450 is that during the SST, the donor node improperly interpolates parameters sent by the joiner into the command line, which could lead to security issues.
When was REDHAT-BUG-2488450 published?
REDHAT-BUG-2488450 was published on June 12, 2026.