PT-2024-3729 · Oracle+4 · Mysql Server+3

Published

2024-04-16

·

Updated

2024-09-18

·

CVE-2024-20998

CVSS v2.0

6.8

Medium

VectorAV:N/AC:L/Au:S/C:N/I:N/A:C
Name of the Vulnerable Software and Affected Versions: MySQL Server versions 8.0.36 and prior MySQL Server versions 8.3.0 and prior
Description: The issue is related to insufficient input validation in the Server: Optimizer component of Oracle MySQL Server. It allows a high-privileged attacker with network access via multiple protocols to compromise MySQL Server, resulting in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.
Recommendations: For MySQL Server versions 8.0.36 and prior, update to a version later than 8.0.36 to resolve the issue. For MySQL Server versions 8.3.0 and prior, update to a version later than 8.3.0 to resolve the issue. As a temporary workaround, consider restricting network access to the MySQL Server to minimize the risk of exploitation.

Fix

DoS

Stack Overflow

RCE

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-121CWE-20

Related Identifiers

ALT-PU-2024-11520
ALT-PU-2024-12462
ALT-PU-2024-7978
ALT-PU-2024-8426
BDU:2024-04075
CVE-2024-20998
OESA-2024-1558
OESA-2024-1559
OESA-2024-1560
OESA-2024-1561
OESA-2024-1744
OESA-2024-2071
USN-6823-1

Affected Products

Alt Linux
Linuxmint
Mysql Server
Ubuntu