PT-2022-5160 · Oracle+7 · Mysql Server+6

Published 2022-10-18 · Updated 2024-08-30 · CVE-2022-21640

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions MySQL Server versions 8.0.30 and prior

Description The issue is related to insufficient input validation in the Server: Optimizer component of MySQL Server. This allows a high-privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks can result in the unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.

Recommendations For versions 8.0.30 and prior, update to a version later than 8.0.30 to resolve the issue. At the moment, there is no information about additional mitigation measures for this specific vulnerability.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALSA-2023:2621

ALSA-2023:3087

ALT-PU-2023-7310

ALT-PU-2023-7463

ALT-PU-2023-7647

ALT-PU-2023-7888

AZL-11213

BDU:2022-06417

CESA-2023_3087

CVE-2022-21640

OESA-2023-1834

OESA-2023-1835

OESA-2023-1836

OESA-2024-2071

RHSA-2023:1102

RHSA-2023:2621

RHSA-2023:3087

RHSA-2023_2621

RHSA-2023_3087

USN-5696-1

Affected Products

Alt Linux

Almalinux

Centos

Linuxmint

Mysql Server

Red Hat

Ubuntu

References · 345

• 🔥 https://github.com/d0rb/CVE-2023-38545 · Exploit
• 🔥 https://github.com/UTsweetyfish/CVE-2023-38545 · Exploit
• 🔥 https://github.com/imfht/CVE-2023-38545 · Exploit
• 🔥 https://github.com/fatmo666/CVE-2023-38545-libcurl-SOCKS5-heap-buffer-overflow · Exploit
• 🔥 https://github.com/vanigori/CVE-2023-38545-sample · Exploit
• 🔥 https://github.com/bcdannyboy/CVE-2023-38545 · Exploit
• 🔥 https://github.com/xen0bit/CVE-2022-37434_poc · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-21881 · Security Note
• https://ubuntu.com/security/CVE-2022-21637 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-21946 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-21454 · Security Note
• https://ubuntu.com/security/CVE-2022-21604 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-22026 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EG3VBUHKCUXVWBSCD2FHCWIAMZO4X3PR · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-21611 · Vendor Advisory