REDHAT-BUG-2488454: High severity MariaDB MariaDB Server vulnerability
MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shell commands on the donor side via the rsync SST method. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MariaDB Serverto a version that resolves this vulnerability.Fixed in 10.6.27 - Upgrade
Upgrade
MariaDB Serverto a version that resolves this vulnerability.Fixed in 10.11.18 - Upgrade
Upgrade
MariaDB Serverto a version that resolves this vulnerability.Fixed in 11.4.12 - Upgrade
Upgrade
MariaDB Serverto a version that resolves this vulnerability.Fixed in 11.8.8 - Upgrade
Upgrade
MariaDB Serverto a version that resolves this vulnerability.Fixed in 12.3.2
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2488454?
The severity of REDHAT-BUG-2488454 is high, rated at 7.
What versions of MariaDB are affected by REDHAT-BUG-2488454?
REDHAT-BUG-2488454 affects MariaDB versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1.
How do I fix REDHAT-BUG-2488454?
To fix REDHAT-BUG-2488454, upgrade to the latest versions of MariaDB that address this vulnerability.
What type of vulnerability is REDHAT-BUG-2488454?
REDHAT-BUG-2488454 is related to improper parameter handling during the SST process in MariaDB.
What implications does REDHAT-BUG-2488454 have on database security?
REDHAT-BUG-2488454 could lead to unauthorized command execution if exploited during the SST.