REDHAT-BUG-2488460: High severity MariaDB MariaDB Server vulnerability
MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, MariaDB allowed SELECT ... INTO OUTFILE and SELECT ... INTO DUMPFILE without verifying the FILE privilege if the FROM clause contained only subqueries. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.6.26 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.11.17 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 11.4.11 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 11.8.7 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 12.3.2
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2488460?
The severity of REDHAT-BUG-2488460 is classified as high (7).
How do I fix REDHAT-BUG-2488460?
To fix REDHAT-BUG-2488460, upgrade MariaDB to version 10.6.26 or later, 10.11.17 or later, 11.4.11 or later, 11.8.7 or later, or 12.4.0.
What versions are affected by REDHAT-BUG-2488460?
The affected versions of MariaDB for REDHAT-BUG-2488460 are 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1.
What impact does REDHAT-BUG-2488460 have on MariaDB users?
REDHAT-BUG-2488460 allows unauthorized access to file system operations which could lead to data exposure.
Is there a workaround for REDHAT-BUG-2488460?
There is no specific workaround; the recommended solution is to upgrade to the fixed versions of MariaDB.