PT-2021-6662 · Mysql Server+1 · Mysql Cluster+1

Published 2021-11-15 · Updated 2023-05-30 · CVE-2022-21290

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:A/AC:H/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions MySQL Cluster versions 8.0.27 and prior

Description The issue is related to a heap-based buffer overflow in the MySQL Cluster component, which can be exploited to execute arbitrary code. This can allow a remote attacker to compromise the MySQL Cluster, potentially leading to a takeover. The exploitation requires high privileges and access to the physical communication segment attached to the hardware where the MySQL Cluster executes, as well as human interaction from a person other than the attacker.

Recommendations For versions 8.0.27 and prior, update to a version that contains a fix for this issue to prevent potential exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Stack Overflow

Weakness Enumeration

CWE-20

CWE-121

Related Identifiers

ALT-PU-2022-1100

ALT-PU-2022-2171

ALT-PU-2023-1912

AZL-7546

BDU:2022-01992

CVE-2022-21290

OESA-2022-1519

ZDI-22-086

Affected Products

Alt Linux

Mysql Cluster

References · 82

• https://nvd.nist.gov/vuln/detail/CVE-2022-21264 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-21309 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-21312 · Security Note
• https://oracle.com/security-alerts/cpujan2022.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-21327 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-21310 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-21358 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-21374 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-21344 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-21372 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-21249 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-21265 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-21351 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-21280 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-21378 · Security Note