1. Home
  2. Security Advisories
  3. AlmaLinux OS
  4. ALSA-2022:6443

[ALSA-2022:6443] mariadb:10.3 security and bug fix update

Severity Moderate
Affected Packages 30
CVEs 35
Info Packages References Vulnerabilities

mariadb:10.3 security and bug fix update

MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL.

The following packages have been upgraded to a later upstream version: mariadb (10.3.35), galera (25.3.35).

Security Fix(es):

  • mariadb: MariaDB through 10.5.9 allows attackers to trigger a convert_const_to_int use-after-free when the BIGINT data type is used (CVE-2021-46669)
  • mysql: Server: FTS unspecified vulnerability (CPU Apr 2022) (CVE-2022-21427)
  • mariadb: lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer (CVE-2022-24048)
  • mariadb: lack of validating the existence of an object prior to performing operations on the object (CVE-2022-24050)
  • mariadb: lack of proper validation of a user-supplied string before using it as a format specifier (CVE-2022-24051)
  • mariadb: CONNECT storage engine heap-based buffer overflow (CVE-2022-24052)
  • mariadb: assertion failure in Item_args::walk_arg (CVE-2022-27376)
  • mariadb: use-after-poison when complex conversion is involved in blob (CVE-2022-27377)
  • mariadb: server crash in create_tmp_table::finalize (CVE-2022-27378)
  • mariadb: server crash in component arg_comparator::compare_real_fixed (CVE-2022-27379)
  • mariadb: server crash at my_decimal::operator= (CVE-2022-27380)
  • mariadb: server crash at Field::set_default via specially crafted SQL statements (CVE-2022-27381)
  • mariadb: use-after-poison in my_strcasecmp_8bit() of ctype-simple.c (CVE-2022-27383)
  • mariadb: crash via component Item_subselect::init_expr_cache_tracker (CVE-2022-27384)
  • mariadb: server crashes in query_arena::set_query_arena upon SELECT from view (CVE-2022-27386)
  • mariadb: assertion failures in decimal_bin_size (CVE-2022-27387)
  • mariadb: assertion failure in compare_order_elements (CVE-2022-27445)
  • mariadb: use-after-poison in Binary_string::free_buffer (CVE-2022-27447)
  • mariadb: crash in multi-update and implicit grouping (CVE-2022-27448)
  • mariadb: assertion failure in sql/item_func.cc (CVE-2022-27449)
  • mariadb: assertion failure in sql/item_cmpfunc.cc (CVE-2022-27452)
  • mariadb: assertion failure in VDec::VDec at /sql/sql_type.cc (CVE-2022-27456)
  • mariadb: use-after-poison in Binary_string::free_buffer (CVE-2022-27458)
  • mariadb: improper locking due to the unreleased lock in extra/mariabackup/ds_compress.cc (CVE-2022-31622)
  • mariadb: improper locking due to the unreleased lock in extra/mariabackup/ds_compress.cc (CVE-2022-31623)
  • mariadb: server crash at Item_subselect::init_expr_cache_tracker (CVE-2022-32083)
  • mariadb: server crash in Item_func_in::cleanup/Item::cleanup_processor (CVE-2022-32085)
  • mariadb: server crash in Item_args::walk_args (CVE-2022-32087)
  • mariadb: segmentation fault in Exec_time_tracker::get_loops/Filesort_tracker::report_use/filesort (CVE-2022-32088)
  • mariadb: Crash executing query with VIEW, aggregate and subquery (CVE-2021-46659)
  • mariadb: MariaDB allows an application crash in find_field_in_tables and find_order_in_list via an unused common table expression (CTE) (CVE-2021-46661)
  • mariadb: MariaDB through 10.5.13 allows a ha_maria::extra application crash via certain SELECT statements (CVE-2021-46663)
  • mariadb: MariaDB through 10.5.9 allows an application crash in sub_select_postjoin_aggr for a NULL value of aggr (CVE-2021-46664)
  • mariadb: MariaDB through 10.5.9 allows a sql_parse.cc application crash because of incorrect used_tables expectations (CVE-2021-46665)
  • mariadb: MariaDB through 10.5.9 allows an application crash via certain long SELECT DISTINCT statements (CVE-2021-46668)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

  • [Tracker] Rebase to Galera 25.3.35 for MariaDB-10.3 (BZ#2107075)
Package Affected Version
pkg:rpm/almalinux/mariadb?arch=x86_64&distro=almalinux-8.6 < 10.3.35-1.module_el8.6.0+3265+230ed96b
pkg:rpm/almalinux/mariadb?arch=aarch64&distro=almalinux-8.6 < 10.3.35-1.module_el8.6.0+3265+230ed96b
pkg:rpm/almalinux/mariadb-test?arch=x86_64&distro=almalinux-8.6 < 10.3.35-1.module_el8.6.0+3265+230ed96b
pkg:rpm/almalinux/mariadb-test?arch=aarch64&distro=almalinux-8.6 < 10.3.35-1.module_el8.6.0+3265+230ed96b
pkg:rpm/almalinux/mariadb-server?arch=x86_64&distro=almalinux-8.6 < 10.3.35-1.module_el8.6.0+3265+230ed96b
pkg:rpm/almalinux/mariadb-server?arch=aarch64&distro=almalinux-8.6 < 10.3.35-1.module_el8.6.0+3265+230ed96b
pkg:rpm/almalinux/mariadb-server-utils?arch=x86_64&distro=almalinux-8.6 < 10.3.35-1.module_el8.6.0+3265+230ed96b
pkg:rpm/almalinux/mariadb-server-utils?arch=aarch64&distro=almalinux-8.6 < 10.3.35-1.module_el8.6.0+3265+230ed96b
pkg:rpm/almalinux/mariadb-server-galera?arch=x86_64&distro=almalinux-8.6 < 10.3.35-1.module_el8.6.0+3265+230ed96b
pkg:rpm/almalinux/mariadb-server-galera?arch=aarch64&distro=almalinux-8.6 < 10.3.35-1.module_el8.6.0+3265+230ed96b
pkg:rpm/almalinux/mariadb-oqgraph-engine?arch=x86_64&distro=almalinux-8.6 < 10.3.35-1.module_el8.6.0+3265+230ed96b
pkg:rpm/almalinux/mariadb-oqgraph-engine?arch=aarch64&distro=almalinux-8.6 < 10.3.35-1.module_el8.6.0+3265+230ed96b
pkg:rpm/almalinux/mariadb-gssapi-server?arch=x86_64&distro=almalinux-8.6 < 10.3.35-1.module_el8.6.0+3265+230ed96b
pkg:rpm/almalinux/mariadb-gssapi-server?arch=aarch64&distro=almalinux-8.6 < 10.3.35-1.module_el8.6.0+3265+230ed96b
pkg:rpm/almalinux/mariadb-errmsg?arch=x86_64&distro=almalinux-8.6 < 10.3.35-1.module_el8.6.0+3265+230ed96b
pkg:rpm/almalinux/mariadb-errmsg?arch=aarch64&distro=almalinux-8.6 < 10.3.35-1.module_el8.6.0+3265+230ed96b
pkg:rpm/almalinux/mariadb-embedded?arch=x86_64&distro=almalinux-8.6 < 10.3.35-1.module_el8.6.0+3265+230ed96b
pkg:rpm/almalinux/mariadb-embedded?arch=aarch64&distro=almalinux-8.6 < 10.3.35-1.module_el8.6.0+3265+230ed96b
pkg:rpm/almalinux/mariadb-embedded-devel?arch=x86_64&distro=almalinux-8.6 < 10.3.35-1.module_el8.6.0+3265+230ed96b
pkg:rpm/almalinux/mariadb-embedded-devel?arch=aarch64&distro=almalinux-8.6 < 10.3.35-1.module_el8.6.0+3265+230ed96b
pkg:rpm/almalinux/mariadb-devel?arch=x86_64&distro=almalinux-8.6 < 10.3.35-1.module_el8.6.0+3265+230ed96b
pkg:rpm/almalinux/mariadb-devel?arch=aarch64&distro=almalinux-8.6 < 10.3.35-1.module_el8.6.0+3265+230ed96b
pkg:rpm/almalinux/mariadb-common?arch=x86_64&distro=almalinux-8.6 < 10.3.35-1.module_el8.6.0+3265+230ed96b
pkg:rpm/almalinux/mariadb-common?arch=aarch64&distro=almalinux-8.6 < 10.3.35-1.module_el8.6.0+3265+230ed96b
pkg:rpm/almalinux/mariadb-backup?arch=x86_64&distro=almalinux-8.6 < 10.3.35-1.module_el8.6.0+3265+230ed96b
pkg:rpm/almalinux/mariadb-backup?arch=aarch64&distro=almalinux-8.6 < 10.3.35-1.module_el8.6.0+3265+230ed96b
pkg:rpm/almalinux/Judy?arch=x86_64&distro=almalinux-8.6 < 1.0.5-18.module_el8.6.0+3072+3c630e87
pkg:rpm/almalinux/Judy?arch=aarch64&distro=almalinux-8.6 < 1.0.5-18.module_el8.6.0+3072+3c630e87
pkg:rpm/almalinux/galera?arch=x86_64&distro=almalinux-8.6 < 25.3.35-1.module_el8.6.0+3265+230ed96b
pkg:rpm/almalinux/galera?arch=aarch64&distro=almalinux-8.6 < 25.3.35-1.module_el8.6.0+3265+230ed96b
ID
ALSA-2022:6443
Severity
moderate
URL
https://errata.almalinux.org/ALSA-2022:6443.html
Published
2022-09-13T00:00:00
(2 years ago)
Modified
2022-10-14T07:41:44
(23 months ago)
Rights
Copyright 2022 AlmaLinux OS
Other Advisories
Source # ID Name URL
RHSA RHSA-2022:6443 https://access.redhat.com/errata/RHSA-2022:6443
CVE CVE-2021-46659 https://access.redhat.com/security/cve/CVE-2021-46659
CVE CVE-2021-46661 https://access.redhat.com/security/cve/CVE-2021-46661
CVE CVE-2021-46663 https://access.redhat.com/security/cve/CVE-2021-46663
CVE CVE-2021-46664 https://access.redhat.com/security/cve/CVE-2021-46664
CVE CVE-2021-46665 https://access.redhat.com/security/cve/CVE-2021-46665
CVE CVE-2021-46668 https://access.redhat.com/security/cve/CVE-2021-46668
CVE CVE-2021-46669 https://access.redhat.com/security/cve/CVE-2021-46669
CVE CVE-2022-21427 https://access.redhat.com/security/cve/CVE-2022-21427
CVE CVE-2022-24048 https://access.redhat.com/security/cve/CVE-2022-24048
CVE CVE-2022-24050 https://access.redhat.com/security/cve/CVE-2022-24050
CVE CVE-2022-24051 https://access.redhat.com/security/cve/CVE-2022-24051
CVE CVE-2022-24052 https://access.redhat.com/security/cve/CVE-2022-24052
CVE CVE-2022-27376 https://access.redhat.com/security/cve/CVE-2022-27376
CVE CVE-2022-27377 https://access.redhat.com/security/cve/CVE-2022-27377
CVE CVE-2022-27378 https://access.redhat.com/security/cve/CVE-2022-27378
CVE CVE-2022-27379 https://access.redhat.com/security/cve/CVE-2022-27379
CVE CVE-2022-27380 https://access.redhat.com/security/cve/CVE-2022-27380
CVE CVE-2022-27381 https://access.redhat.com/security/cve/CVE-2022-27381
CVE CVE-2022-27383 https://access.redhat.com/security/cve/CVE-2022-27383
CVE CVE-2022-27384 https://access.redhat.com/security/cve/CVE-2022-27384
CVE CVE-2022-27386 https://access.redhat.com/security/cve/CVE-2022-27386
CVE CVE-2022-27387 https://access.redhat.com/security/cve/CVE-2022-27387
CVE CVE-2022-27445 https://access.redhat.com/security/cve/CVE-2022-27445
CVE CVE-2022-27447 https://access.redhat.com/security/cve/CVE-2022-27447
CVE CVE-2022-27448 https://access.redhat.com/security/cve/CVE-2022-27448
CVE CVE-2022-27449 https://access.redhat.com/security/cve/CVE-2022-27449
CVE CVE-2022-27452 https://access.redhat.com/security/cve/CVE-2022-27452
CVE CVE-2022-27456 https://access.redhat.com/security/cve/CVE-2022-27456
CVE CVE-2022-27458 https://access.redhat.com/security/cve/CVE-2022-27458
CVE CVE-2022-31622 https://access.redhat.com/security/cve/CVE-2022-31622
CVE CVE-2022-31623 https://access.redhat.com/security/cve/CVE-2022-31623
CVE CVE-2022-32083 https://access.redhat.com/security/cve/CVE-2022-32083
CVE CVE-2022-32085 https://access.redhat.com/security/cve/CVE-2022-32085
CVE CVE-2022-32087 https://access.redhat.com/security/cve/CVE-2022-32087
CVE CVE-2022-32088 https://access.redhat.com/security/cve/CVE-2022-32088
Bugzilla 2049302 https://bugzilla.redhat.com/2049302
Bugzilla 2050017 https://bugzilla.redhat.com/2050017
Bugzilla 2050022 https://bugzilla.redhat.com/2050022
Bugzilla 2050024 https://bugzilla.redhat.com/2050024
Bugzilla 2050026 https://bugzilla.redhat.com/2050026
Bugzilla 2050032 https://bugzilla.redhat.com/2050032
Bugzilla 2050034 https://bugzilla.redhat.com/2050034
Bugzilla 2068211 https://bugzilla.redhat.com/2068211
Bugzilla 2068233 https://bugzilla.redhat.com/2068233
Bugzilla 2068234 https://bugzilla.redhat.com/2068234
Bugzilla 2069833 https://bugzilla.redhat.com/2069833
Bugzilla 2074817 https://bugzilla.redhat.com/2074817
Bugzilla 2074947 https://bugzilla.redhat.com/2074947
Bugzilla 2074949 https://bugzilla.redhat.com/2074949
Bugzilla 2074951 https://bugzilla.redhat.com/2074951
Bugzilla 2074966 https://bugzilla.redhat.com/2074966
Bugzilla 2074981 https://bugzilla.redhat.com/2074981
Bugzilla 2074996 https://bugzilla.redhat.com/2074996
Bugzilla 2074999 https://bugzilla.redhat.com/2074999
Bugzilla 2075005 https://bugzilla.redhat.com/2075005
Bugzilla 2075006 https://bugzilla.redhat.com/2075006
Bugzilla 2075691 https://bugzilla.redhat.com/2075691
Bugzilla 2075693 https://bugzilla.redhat.com/2075693
Bugzilla 2075694 https://bugzilla.redhat.com/2075694
Bugzilla 2075695 https://bugzilla.redhat.com/2075695
Bugzilla 2075697 https://bugzilla.redhat.com/2075697
Bugzilla 2075700 https://bugzilla.redhat.com/2075700
Bugzilla 2076145 https://bugzilla.redhat.com/2076145
Bugzilla 2082644 https://bugzilla.redhat.com/2082644
Bugzilla 2092354 https://bugzilla.redhat.com/2092354
Bugzilla 2092360 https://bugzilla.redhat.com/2092360
Bugzilla 2104425 https://bugzilla.redhat.com/2104425
Bugzilla 2104431 https://bugzilla.redhat.com/2104431
Bugzilla 2104434 https://bugzilla.redhat.com/2104434
Bugzilla 2106008 https://bugzilla.redhat.com/2106008
Self ALSA-2022:6443 https://errata.almalinux.org/8/ALSA-2022-6443.html
Type Package URL Namespace Name / Product Version Distribution / Platform Arch Patch / Fix
Affected pkg:rpm/almalinux/mariadb?arch=x86_64&distro=almalinux-8.6 almalinux mariadb < 10.3.35-1.module_el8.6.0+3265+230ed96b almalinux-8.6 x86_64
Affected pkg:rpm/almalinux/mariadb?arch=aarch64&distro=almalinux-8.6 almalinux mariadb < 10.3.35-1.module_el8.6.0+3265+230ed96b almalinux-8.6 aarch64
Affected pkg:rpm/almalinux/mariadb-test?arch=x86_64&distro=almalinux-8.6 almalinux mariadb-test < 10.3.35-1.module_el8.6.0+3265+230ed96b almalinux-8.6 x86_64
Affected pkg:rpm/almalinux/mariadb-test?arch=aarch64&distro=almalinux-8.6 almalinux mariadb-test < 10.3.35-1.module_el8.6.0+3265+230ed96b almalinux-8.6 aarch64
Affected pkg:rpm/almalinux/mariadb-server?arch=x86_64&distro=almalinux-8.6 almalinux mariadb-server < 10.3.35-1.module_el8.6.0+3265+230ed96b almalinux-8.6 x86_64
Affected pkg:rpm/almalinux/mariadb-server?arch=aarch64&distro=almalinux-8.6 almalinux mariadb-server < 10.3.35-1.module_el8.6.0+3265+230ed96b almalinux-8.6 aarch64
Affected pkg:rpm/almalinux/mariadb-server-utils?arch=x86_64&distro=almalinux-8.6 almalinux mariadb-server-utils < 10.3.35-1.module_el8.6.0+3265+230ed96b almalinux-8.6 x86_64
Affected pkg:rpm/almalinux/mariadb-server-utils?arch=aarch64&distro=almalinux-8.6 almalinux mariadb-server-utils < 10.3.35-1.module_el8.6.0+3265+230ed96b almalinux-8.6 aarch64
Affected pkg:rpm/almalinux/mariadb-server-galera?arch=x86_64&distro=almalinux-8.6 almalinux mariadb-server-galera < 10.3.35-1.module_el8.6.0+3265+230ed96b almalinux-8.6 x86_64
Affected pkg:rpm/almalinux/mariadb-server-galera?arch=aarch64&distro=almalinux-8.6 almalinux mariadb-server-galera < 10.3.35-1.module_el8.6.0+3265+230ed96b almalinux-8.6 aarch64
Affected pkg:rpm/almalinux/mariadb-oqgraph-engine?arch=x86_64&distro=almalinux-8.6 almalinux mariadb-oqgraph-engine < 10.3.35-1.module_el8.6.0+3265+230ed96b almalinux-8.6 x86_64
Affected pkg:rpm/almalinux/mariadb-oqgraph-engine?arch=aarch64&distro=almalinux-8.6 almalinux mariadb-oqgraph-engine < 10.3.35-1.module_el8.6.0+3265+230ed96b almalinux-8.6 aarch64
Affected pkg:rpm/almalinux/mariadb-gssapi-server?arch=x86_64&distro=almalinux-8.6 almalinux mariadb-gssapi-server < 10.3.35-1.module_el8.6.0+3265+230ed96b almalinux-8.6 x86_64
Affected pkg:rpm/almalinux/mariadb-gssapi-server?arch=aarch64&distro=almalinux-8.6 almalinux mariadb-gssapi-server < 10.3.35-1.module_el8.6.0+3265+230ed96b almalinux-8.6 aarch64
Affected pkg:rpm/almalinux/mariadb-errmsg?arch=x86_64&distro=almalinux-8.6 almalinux mariadb-errmsg < 10.3.35-1.module_el8.6.0+3265+230ed96b almalinux-8.6 x86_64
Affected pkg:rpm/almalinux/mariadb-errmsg?arch=aarch64&distro=almalinux-8.6 almalinux mariadb-errmsg < 10.3.35-1.module_el8.6.0+3265+230ed96b almalinux-8.6 aarch64
Affected pkg:rpm/almalinux/mariadb-embedded?arch=x86_64&distro=almalinux-8.6 almalinux mariadb-embedded < 10.3.35-1.module_el8.6.0+3265+230ed96b almalinux-8.6 x86_64
Affected pkg:rpm/almalinux/mariadb-embedded?arch=aarch64&distro=almalinux-8.6 almalinux mariadb-embedded < 10.3.35-1.module_el8.6.0+3265+230ed96b almalinux-8.6 aarch64
Affected pkg:rpm/almalinux/mariadb-embedded-devel?arch=x86_64&distro=almalinux-8.6 almalinux mariadb-embedded-devel < 10.3.35-1.module_el8.6.0+3265+230ed96b almalinux-8.6 x86_64
Affected pkg:rpm/almalinux/mariadb-embedded-devel?arch=aarch64&distro=almalinux-8.6 almalinux mariadb-embedded-devel < 10.3.35-1.module_el8.6.0+3265+230ed96b almalinux-8.6 aarch64
Affected pkg:rpm/almalinux/mariadb-devel?arch=x86_64&distro=almalinux-8.6 almalinux mariadb-devel < 10.3.35-1.module_el8.6.0+3265+230ed96b almalinux-8.6 x86_64
Affected pkg:rpm/almalinux/mariadb-devel?arch=aarch64&distro=almalinux-8.6 almalinux mariadb-devel < 10.3.35-1.module_el8.6.0+3265+230ed96b almalinux-8.6 aarch64
Affected pkg:rpm/almalinux/mariadb-common?arch=x86_64&distro=almalinux-8.6 almalinux mariadb-common < 10.3.35-1.module_el8.6.0+3265+230ed96b almalinux-8.6 x86_64
Affected pkg:rpm/almalinux/mariadb-common?arch=aarch64&distro=almalinux-8.6 almalinux mariadb-common < 10.3.35-1.module_el8.6.0+3265+230ed96b almalinux-8.6 aarch64
Affected pkg:rpm/almalinux/mariadb-backup?arch=x86_64&distro=almalinux-8.6 almalinux mariadb-backup < 10.3.35-1.module_el8.6.0+3265+230ed96b almalinux-8.6 x86_64
Affected pkg:rpm/almalinux/mariadb-backup?arch=aarch64&distro=almalinux-8.6 almalinux mariadb-backup < 10.3.35-1.module_el8.6.0+3265+230ed96b almalinux-8.6 aarch64
Affected pkg:rpm/almalinux/Judy?arch=x86_64&distro=almalinux-8.6 almalinux Judy < 1.0.5-18.module_el8.6.0+3072+3c630e87 almalinux-8.6 x86_64
Affected pkg:rpm/almalinux/Judy?arch=aarch64&distro=almalinux-8.6 almalinux Judy < 1.0.5-18.module_el8.6.0+3072+3c630e87 almalinux-8.6 aarch64
Affected pkg:rpm/almalinux/galera?arch=x86_64&distro=almalinux-8.6 almalinux galera < 25.3.35-1.module_el8.6.0+3265+230ed96b almalinux-8.6 x86_64
Affected pkg:rpm/almalinux/galera?arch=aarch64&distro=almalinux-8.6 almalinux galera < 25.3.35-1.module_el8.6.0+3265+230ed96b almalinux-8.6 aarch64
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories Exploits PoC Pubblication Date Modification Date
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories PoC Pubblication Date Modification Date