PT-2023-15909 · Oracle+10 · Mysql Server+9
Yiyuaner
·
Publicado
2022-07-17
·
Atualizado
2025-08-19
·
CVE-2022-4899
CVSS v2.0
7.8
Alta
| Vetor | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
zstd version 1.4.10
MySQL Server versions 8.0.33 and earlier
Description
A vulnerability was found where an attacker can supply an empty string as an argument to the command line tool to cause buffer overrun. This issue can be exploited by a high-privileged attacker with network access via multiple protocols to compromise MySQL Server, potentially resulting in unauthorized ability to cause a hang or frequently repeatable crash of MySQL Server.
Recommendations
For zstd version 1.4.10, consider disabling the command line tool until a patch is available.
For MySQL Server versions 8.0.33 and earlier, update to a version later than 8.0.33 to resolve the issue.
As a temporary workaround, restrict access to the command line tool to minimize the risk of exploitation.
Correção
DoS
Resource Exhaustion
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Almalinux
Astra Linux
Centos
Debian
Mysql Server
Red Hat
Rocky Linux
Suse
Zstd