PT-2022-3739 · Oracle · Mysql Cluster

Published 2022-07-19 · Updated 2022-09-04 · CVE-2022-21519

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions MySQL Cluster versions 8.0.29 and prior

Description The issue is related to insufficient input validation in the MySQL Cluster product, which can be exploited by a remote attacker to cause a denial of service. This can result in the ability to cause a hang or frequently repeatable crash of MySQL Cluster. The vulnerability can be exploited by an unauthenticated attacker with network access via multiple protocols.

Recommendations For versions 8.0.29 and prior, update to a version that includes the fix for this issue to prevent exploitation. As a temporary workaround, consider restricting network access to the MySQL Cluster to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2022-04527

CVE-2022-21519

Affected Products

Mysql Cluster

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2022-21519 · Security Note
• https://oracle.com/security-alerts/cpujul2022.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-04527 · Security Note
• https://osv.dev/vulnerability/CVE-2022-21519 · Vendor Advisory
• https://t.me/cvenotify/33456 · Telegram Post
• https://security.netapp.com/advisory/ntap-20220729-0004 · Note
• https://t.me/cvenotify/33654 · Telegram Post