PT-2023-9675 · Oracle+2 · Mysql Server+1

Published 2023-12-07 · Updated 2024-11-02 · CVE-2024-21207

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions MySQL Server versions 8.0.38 and prior MySQL Server versions 8.4.1 and prior MySQL Server versions 9.0.1 and prior

Description The issue is related to insufficient input validation in the InnoDB component of the MySQL Server. Exploitation of this issue can allow a remote attacker to cause a denial of service using the MySQL protocol. Successful attacks can result in the ability to cause the MySQL Server to hang or crash repeatedly, leading to a complete denial of service.

Recommendations For MySQL Server versions 8.0.38 and prior, update to a version that includes the fix for this issue. For MySQL Server versions 8.4.1 and prior, update to a version that includes the fix for this issue. For MySQL Server versions 9.0.1 and prior, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting network access to the MySQL Server to minimize the risk of exploitation.

Fix

DoS

Improper Resource Release

RCE

Resource Exhaustion

Weakness Enumeration

CWE-404

CWE-20

CWE-400

Related Identifiers

ALT-PU-2024-14481

ALT-PU-2024-14548

ALT-PU-2024-14706

ALT-PU-2024-14708

AZL-50396

AZL-50423

BDU:2024-09647

CVE-2024-21207

OESA-2024-2287

Affected Products

Alt Linux

Mysql Server

References · 39

• https://nvd.nist.gov/vuln/detail/CVE-2024-21203 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-21193 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-21207 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-21207 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-21237 · Security Note
• https://oracle.com/security-alerts/cpuoct2024.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-21197 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-21231 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-21207 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-21196 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-21213 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-21230 · Security Note
• https://bdu.fstec.ru/vul/2024-09647 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-21239 · Security Note
• https://cve.org/CVERecord?id=CVE-2024-21207 · Security Note