PT-2019-5796 · Oracle+7 · Mysql Server+6

Published

2015-09-02

·

Updated

2025-06-10

·

CVE-2021-2144

CVSS v2.0

9.0

High

VectorAV:N/AC:L/Au:S/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions Oracle MySQL Server versions 5.7.29 and prior Oracle MySQL Server versions 8.0.19 and prior
Description The issue is related to insufficient input validation in the Server: Parser component of Oracle MySQL Server. This allows a remote attacker to potentially execute arbitrary code using the MySQL network protocol. The vulnerability can be easily exploited by a high-privileged attacker with network access via multiple protocols, leading to a takeover of the MySQL Server.
Recommendations For Oracle MySQL Server versions 5.7.29 and prior, update to a version later than 5.7.29 to resolve the issue. For Oracle MySQL Server versions 8.0.19 and prior, update to a version later than 8.0.19 to resolve the issue. As a temporary workaround, consider restricting network access to the MySQL Server to minimize the risk of exploitation.

Exploit

Fix

RCE

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-20

Related Identifiers

ALSA-2020:3732
ALSA-2020:5500
ALT-PU-2015-1749
ALT-PU-2019-3245
ALT-PU-2019-3279
ALT-PU-2020-1885
ALT-PU-2020-1904
ALT-PU-2021-1686
ALT-PU-2021-2380
ALT-PU-2021-3668
BDU:2021-02455
BIT-MARIADB-2021-2144
BIT-MARIADB-MIN-2021-2144
BIT-MYSQL-CLIENT-2021-2144
CESA-2020_3732
CESA-2020_4026
CESA-2020_5500
CVE-2021-2144
RHSA-2020:3518
RHSA-2020:3732
RHSA-2020:3755
RHSA-2020:3757
RHSA-2020:4026
RHSA-2020:5246
RHSA-2020:5500
RHSA-2020:5654
RHSA-2020:5663
RHSA-2020:5665
RHSA-2020_3732
RHSA-2020_4026
RHSA-2020_5500
RLSA-2020:3732
RLSA-2020:5500

Affected Products

Alt Linux
Almalinux
Centos
Mariadb Server
Mysql Server
Red Hat
Rocky Linux