PT-2023-15909 · Oracle+10 · Mysql Server+9
Yiyuaner
·
Published
2022-07-17
·
Updated
2025-08-19
·
CVE-2022-4899
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
zstd version 1.4.10
MySQL Server versions 8.0.33 and earlier
Description
A vulnerability was found where an attacker can supply an empty string as an argument to the command line tool to cause buffer overrun. This issue can be exploited by a high-privileged attacker with network access via multiple protocols to compromise MySQL Server, potentially resulting in unauthorized ability to cause a hang or frequently repeatable crash of MySQL Server.
Recommendations
For zstd version 1.4.10, consider disabling the command line tool until a patch is available.
For MySQL Server versions 8.0.33 and earlier, update to a version later than 8.0.33 to resolve the issue.
As a temporary workaround, restrict access to the command line tool to minimize the risk of exploitation.
Fix
DoS
Resource Exhaustion
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Debian
Mysql Server
Red Hat
Rocky Linux
Suse
Zstd