PT-2021-7186 · Oracle · Oracle Mysql Cluster

Gianluca Danesin · Published 2021-07-20 · Updated 2021-07-23 · CVE-2021-2411

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Oracle MySQL Cluster versions 8.0.25 and prior

Description The issue exists due to insufficient input validation in the Cluster: JS module of the Oracle MySQL Cluster system. This allows a remote attacker to cause a partial denial of service (DOS) of MySQL Cluster via multiple protocols. The attacker does not need authentication and can access the system through the network. Successful exploitation can result in unauthorized ability to cause a partial denial of service.

Recommendations For versions 8.0.25 and prior, consider restricting network access to the Cluster: JS module until a patch is available. As a temporary workaround, limit the use of the affected module to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2022-03669

CVE-2021-2411

Affected Products

Oracle Mysql Cluster

References · 6

• https://oracle.com/security-alerts/cpujul2021.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-2411 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-03669 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-2411 · Security Note
• https://t.me/cvenotify/17960 · Telegram Post
• https://security.netapp.com/advisory/ntap-20210723-0001 · Note