PT-2021-7326 · Mariadb+6 · Mariadb+7

Zuming Jiang · Published 2021-11-08 · Updated 2025-06-10 · CVE-2021-46667

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions MariaDB versions prior to 10.6.5

Description The issue is related to an integer overflow in the sql lex.cc component of MariaDB, which can lead to an application crash. This can be exploited by an attacker to cause a denial of service.

Recommendations For versions prior to 10.6.5, update to version 10.6.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the sql lex.cc component to minimize the risk of exploitation.

Exploit

Fix

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

ALSA-2022:1556

ALSA-2022:1557

ALT-PU-2022-2360

ALT-PU-2022-2446

ALT-PU-2023-1583

ALT-PU-2023-6462

AZL-8411

BDU:2022-05691

BIT-MARIADB-2021-46667

BIT-MARIADB-MIN-2021-46667

BIT-MYSQL-CLIENT-2021-46667

CESA-2022_1556

CESA-2022_1557

CVE-2021-46667

OESA-2022-1587

RHSA-2022:1007

RHSA-2022:1010

RHSA-2022:1556

RHSA-2022:1557

RHSA-2022:4818

RHSA-2022_1556

RHSA-2022_1557

RHSA-2023:6821

RLSA-2022:1556

RLSA-2022:1557

ROSA-SA-2023-2252

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Mariadb

Mariadb Server

Red Hat

Rocky Linux

References · 86

• 🔥 https://github.com/drago-96/CVE-2022-0778 · Exploit
• 🔥 https://github.com/Al1ex/CVE-2021-27928 · Exploit
• 🔥 https://github.com/yywing/cve-2022-0778 · Exploit
• 🔥 https://github.com/jkakavas/CVE-2022-0778-POC · Exploit
• 🔥 https://jira.mariadb.org/browse/MDEV-26350 · Exploit
• 🔥❌ https://github.com/GatoGamer1155/CVE-2021-27928 · Exploit, Deleted
• https://nvd.nist.gov/vuln/detail/CVE-2021-46667 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2021-46667 · Vendor Advisory
• https://errata.almalinux.org/8/ALSA-2022-1557.html · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NJ4KDAGF3H4D4BDTHRAM6ZEAJJWWMRUO · Vendor Advisory
• https://mariadb.com/kb/en/security · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2022-1557.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-46669 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-46667 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DKJRBYJAQCOPHSED43A3HUPNKQLDTFGD · Vendor Advisory