Sergei Golubchik

**Name of the Vulnerable Software and Affected Versions** MariaDB versions prior to 10.5 MariaDB mariadb-dump Utility (affected versions not specified) **Description** The mariadb-dump utility contains a directory traversal flaw that could lead to remote code execution. The utility does not properly sanitize user-supplied input, allowing an attacker to potentially access and manipulate files outside the intended directory. This could allow an attacker to execute arbitrary code on the system. **Recommendations** Update MariaDB to version 10.5 or later.

**Name of the Vulnerable Software and Affected Versions** MariaDB versions 10.2 through 10.2.37 MariaDB versions 10.3 through 10.3.28 MariaDB versions 10.4 through 10.4.18 MariaDB versions 10.5 through 10.5.9 Percona Server through 2021-03-03 wsrep patch through 2021-03-03 for MySQL **Description** The issue is related to a remote code execution problem in MariaDB, where an untrusted search path leads to eval injection. This allows a database SUPER user to execute OS commands after modifying `wsrep provider` and `wsrep notify cmd`. The vulnerability is due to the lack of input validation. **Recommendations** For MariaDB versions 10.2 through 10.2.37, update to version 10.2.37 or later. For MariaDB versions 10.3 through 10.3.28, update to version 10.3.28 or later. For MariaDB versions 10.4 through 10.4.18, update to version 10.4.18 or later. For MariaDB versions 10.5 through 10.5.9, update to version 10.5.9 or later. For Percona Server through 2021-03-03, update to a version later than 2021-03-03. For wsrep patch through 2021-03-03 for MySQL, update to a version later than 2021-03-03. As a temporary workaround, consider restricting access to the `wsrep provider` and `wsrep notify cmd` variables to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Oracle MySQL versions 5.1.x through 5.1.62, 5.5.x through 5.5.23, and 5.6.x through 5.6.5 MariaDB versions 5.1.x through 5.1.61, 5.2.x through 5.2.11, 5.3.x through 5.3.5, and 5.5.x through 5.5.22 **Description** The issue allows remote attackers to bypass authentication by repeatedly authenticating with the same incorrect password, which eventually causes a token comparison to succeed due to an improperly-checked return value. This occurs when running in certain environments with certain implementations of the `memcmp` function. **Recommendations** For Oracle MySQL versions 5.1.x through 5.1.62, update to version 5.1.63 or later. For Oracle MySQL versions 5.5.x through 5.5.23, update to version 5.5.24 or later. For Oracle MySQL versions 5.6.x through 5.6.5, update to version 5.6.6 or later. For MariaDB versions 5.1.x through 5.1.61, update to version 5.1.62 or later. For MariaDB versions 5.2.x through 5.2.11, update to version 5.2.12 or later. For MariaDB versions 5.3.x through 5.3.5, update to version 5.3.6 or later. For MariaDB versions 5.5.x through 5.5.22, update to version 5.5.23 or later.

**Name of the Vulnerable Software and Affected Versions** mariadb104 (affected versions not specified) **Description** The issue concerns security fixes in the mariadb104 package, including the implementation of version 10.4 of MariaDB, which allows for multiple authentication plugins per user account and stores user accounts, passwords, and global privileges in the mysql.global priv table. It also includes support for User Password Expiry, faster privilege checks, and fixes for issues such as MariaDB ignoring the 'open files limit' parameter. Additionally, updates to mysql-systemd-helper and support for lz4 compression in 'INNODB' are included. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: MySQL versions 3.23.58 and earlier Description: A local user with privileges for a database whose name includes a " " (underscore) can grant privileges to other databases with similar names, allowing unauthorized activities. Recommendations: For MySQL versions 3.23.58 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.