PT-2021-6832 · Oracle+8 · Mysql Server+7

Published 2021-07-20 · Updated 2021-12-31 · CVE-2021-2374

Positive Technologies (AI Summary)

CVSS v2.0

4.4

Medium

Base vector

AV:L/AC:M/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions MySQL Server versions 8.0.25 and prior

Description The issue is related to the InnoDB component of the MySQL Server product, allowing a high-privileged attacker with logon to the infrastructure where MySQL Server executes to compromise the server. This can result in unauthorized access to critical data or complete access to all MySQL Server accessible data. The vulnerability is difficult to exploit and is associated with information disclosure.

Recommendations For versions 8.0.25 and prior, update to a version later than 8.0.25 to resolve the issue. At the moment, there is no information about additional mitigation measures for this specific vulnerability.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

ALSA-2021:3590

ALT-PU-2021-2461

ALT-PU-2021-2477

ALT-PU-2021-2571

ALT-PU-2021-3668

BDU:2022-02257

CESA-2021_3590

CVE-2021-2374

OESA-2021-1375

RHSA-2021:3590

RHSA-2021:3811

RHSA-2021_3590

RLSA-2021:3590

USN-5022-1

Affected Products

Alt Linux

Almalinux

Centos

Linuxmint

Mysql Server

Red Hat

Rocky Linux

Ubuntu

References · 361

• 🔥 https://github.com/terorie/cve-2021-3449 · Exploit
• 🔥 https://github.com/riptl/cve-2021-3449 · Exploit
• 🔥 https://github.com/motikan2010/CVE-2020-5398 · Exploit
• 🔥 https://github.com/LeadroyaL/cve-2019-14540-exploit · Exploit
• 🔥 https://github.com/irsl/CVE-2020-1967 · Exploit
• 🔥 https://github.com/MBHudson/CVE-2020-1971 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-2427 · Security Note
• https://ubuntu.com/security/CVE-2021-2389 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2021:3590 · Vendor Advisory
• https://oracle.com/security-alerts/cpujul2021.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-2370 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6OO2Q5PIFURXLLKCIJE6XF6VL4LLMNO5 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-2402 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-2340 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-2422 · Vendor Advisory