PT-2024-3451 · Oracle+5 · Mysql Server+4

Published 2024-02-20 · Updated 2025-06-27 · CVE-2024-21052

Positive Technologies (AI Summary)

CVSS v2.0

6.1

Medium

Base vector

AV:N/AC:L/Au:M/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions: Oracle MySQL Server versions 8.0.34 and prior

Description: The issue allows a high privileged attacker with network access via multiple protocols to compromise the MySQL Server. Successful attacks can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of the MySQL Server. This is due to insufficient access control in the Server: DML component.

Recommendations: For Oracle MySQL Server versions 8.0.34 and prior, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Improper Resource Release

Weakness Enumeration

CWE-404

Related Identifiers

ALT-PU-2024-11520

ALT-PU-2024-12462

ALT-PU-2024-7978

ALT-PU-2024-8426

BDU:2024-03737

CESA-2024_0894

CVE-2024-21052

INFSA-2024_1141

OESA-2025-1672

RHSA-2024:0894

RHSA-2024:1141

RHSA-2024:2619

RHSA-2024_0894

RHSA-2024_1141

Affected Products

Alt Linux

Centos

Mysql Server

Red Hat

Rocky Linux

References · 15

• https://cve.org/CVERecord?id=CVE-2024-21052 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-21052 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-03737 · Security Note
• https://osv.dev/vulnerability/OESA-2025-1672 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-21052 · Security Note
• https://ubuntu.com/security/CVE-2024-21052 · Vendor Advisory
• https://oracle.com/security-alerts/cpuapr2024.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-21052 · Vendor Advisory
• https://openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1672 · Note
• https://security.netapp.com/advisory/ntap-20240426-0012 · Note
• https://t.me/cvenotify/102913 · Telegram Post
• https://mysupport.netapp.com/site/downloads · Note
• https://altsp.su/obnovleniya-bezopasnosti · Note
• https://twitter.com/CVEnew/status/1780349946295648384 · Twitter Post
• https://oracle.com/security-alerts/cpuapr2024.html#AppendixMSQL · Note