RedHat: RHSA-2022-5759:01 Moderate: rh-mariadb105-galera and
Summary
MariaDB is a multi-user, multi-threaded SQL database server. For all
practical purposes, MariaDB is binary-compatible with MySQL.
The following packages have been upgraded to a later upstream version:
rh-mariadb105-galera (26.4.11), rh-mariadb105-mariadb (10.5.16).
Security Fix(es):
* mariadb: convert_const_to_int use-after-free when the BIGINT data type is
used (CVE-2021-46669)
* mariadb: lack of proper validation of the length of user-supplied data
prior to copying it to a fixed-length stack-based buffer (CVE-2022-24048)
* mariadb: lack of validating the existence of an object prior to
performing operations on the object (CVE-2022-24050)
* mariadb: lack of proper validation of a user-supplied string before using
it as a format specifier (CVE-2022-24051)
* mariadb: CONNECT storage engine heap-based buffer overflow
(CVE-2022-24052)
* mariadb: assertion failure in Item_args::walk_arg (CVE-2022-27376)
* mariadb: use-after-poison when complex conversion is involved in blob
(CVE-2022-27377)
* mariadb: crash in create_tmp_table::finalize (CVE-2022-27378)
* mariadb: crash in arg_comparator::compare_real_fixed (CVE-2022-27379)
* mariadb: crash at my_decimal::operator= (CVE-2022-27380)
* mariadb: crash at Field::set_default via specially crafted SQL statements
(CVE-2022-27381)
* mariadb: assertion failure via
Item_field::used_tables/update_depend_map_for_order (CVE-2022-27382)
* mariadb: use-after-poison in my_strcasecmp_8bit() of ctype-simple.c
(CVE-2022-27383)
* mariadb: crash via Item_subselect::init_expr_cache_tracker
(CVE-2022-27384)
* mariadb: crashe in query_arena::set_query_arena upon SELECT from view
(CVE-2022-27386)
* mariadb: assertion failures in decimal_bin_size (CVE-2022-27387)
* mariadb: crash when using HAVING with NOT EXIST predicate in an equality
(CVE-2022-27444)
* mariadb: assertion failure in compare_order_elements (CVE-2022-27445)
* mariadb: crash when using HAVING with IS NULL predicate in an equality
(CVE-2022-27446)
* mariadb: use-after-poison in Binary_string::free_buffer (CVE-2022-27447)
* mariadb: crash in multi-update and implicit grouping (CVE-2022-27448)
* mariadb: assertion failure in sql/item_func.cc (CVE-2022-27449)
* mariadb: crash via window function in expression in ORDER BY
(CVE-2022-27451)
* mariadb: assertion failure in sql/item_cmpfunc.cc (CVE-2022-27452)
* mariadb: use-after-free when WHERE has subquery with an outer reference
in HAVING (CVE-2022-27455)
* mariadb: assertion failure in VDec::VDec at /sql/sql_type.cc
(CVE-2022-27456)
* mariadb: incorrect key in "dup value" error after long unique
(CVE-2022-27457)
* mariadb: use-after-poison in Binary_string::free_buffer (CVE-2022-27458)
* mariadb: improper locking in ds_compress.cc (CVE-2022-31622)
* mariadb: improper locking in ds_compress.cc (CVE-2022-31623)
* mariadb: crash at init_expr_cache_tracker (CVE-2022-32083)
* mariadb: crash in cleanup/Item::cleanup_processor (CVE-2022-32085)
* mariadb: crash in fix_outer_field for INSERT SELECT (CVE-2022-32086)
* mariadb: crash in Item_args::walk_args (CVE-2022-32087)
* mariadb: segmentation fault in get_loops/report_use/filesort
(CVE-2022-32088)
* mariadb: crash executing query with VIEW, aggregate and subquery
(CVE-2021-46659)
* mariadb: crash via an unused common table expression (CTE)
(CVE-2021-46661)
* mariadb: ha_maria::extra crash via certain SELECT statements
(CVE-2021-46663)
* mariadb: crash in sub_select_postjoin_aggr for a NULL value of aggr
(CVE-2021-46664)
* mariadb: sql_parse.cc crash because of used_tables expectations
(CVE-2021-46665)
* mariadb: application crash via long SELECT DISTINCT statements
(CVE-2021-46668)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
Bug Fix(es):
* Don't use less parallelism if not necessary (BZ#2101776)
* [Tracker] Rebase to Galera 26.4.11 (BZ#2101783)
Summary
Solution
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
After installing this update, the MariaDB server daemon (mysqld) will be
restarted automatically.
References
https://access.redhat.com/security/cve/CVE-2021-46659 https://access.redhat.com/security/cve/CVE-2021-46661 https://access.redhat.com/security/cve/CVE-2021-46663 https://access.redhat.com/security/cve/CVE-2021-46664 https://access.redhat.com/security/cve/CVE-2021-46665 https://access.redhat.com/security/cve/CVE-2021-46668 https://access.redhat.com/security/cve/CVE-2021-46669 https://access.redhat.com/security/cve/CVE-2022-24048 https://access.redhat.com/security/cve/CVE-2022-24050 https://access.redhat.com/security/cve/CVE-2022-24051 https://access.redhat.com/security/cve/CVE-2022-24052 https://access.redhat.com/security/cve/CVE-2022-27376 https://access.redhat.com/security/cve/CVE-2022-27377 https://access.redhat.com/security/cve/CVE-2022-27378 https://access.redhat.com/security/cve/CVE-2022-27379 https://access.redhat.com/security/cve/CVE-2022-27380 https://access.redhat.com/security/cve/CVE-2022-27381 https://access.redhat.com/security/cve/CVE-2022-27382 https://access.redhat.com/security/cve/CVE-2022-27383 https://access.redhat.com/security/cve/CVE-2022-27384 https://access.redhat.com/security/cve/CVE-2022-27386 https://access.redhat.com/security/cve/CVE-2022-27387 https://access.redhat.com/security/cve/CVE-2022-27444 https://access.redhat.com/security/cve/CVE-2022-27445 https://access.redhat.com/security/cve/CVE-2022-27446 https://access.redhat.com/security/cve/CVE-2022-27447 https://access.redhat.com/security/cve/CVE-2022-27448 https://access.redhat.com/security/cve/CVE-2022-27449 https://access.redhat.com/security/cve/CVE-2022-27451 https://access.redhat.com/security/cve/CVE-2022-27452 https://access.redhat.com/security/cve/CVE-2022-27455 https://access.redhat.com/security/cve/CVE-2022-27456 https://access.redhat.com/security/cve/CVE-2022-27457 https://access.redhat.com/security/cve/CVE-2022-27458 https://access.redhat.com/security/cve/CVE-2022-31622 https://access.redhat.com/security/cve/CVE-2022-31623 https://access.redhat.com/security/cve/CVE-2022-32083 https://access.redhat.com/security/cve/CVE-2022-32085 https://access.redhat.com/security/cve/CVE-2022-32086 https://access.redhat.com/security/cve/CVE-2022-32087 https://access.redhat.com/security/cve/CVE-2022-32088 https://access.redhat.com/security/updates/classification/#moderate
Package List
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7):
Source:
rh-mariadb105-galera-26.4.11-1.el7.src.rpm
rh-mariadb105-mariadb-10.5.16-2.el7.src.rpm
ppc64le:
rh-mariadb105-galera-26.4.11-1.el7.ppc64le.rpm
rh-mariadb105-galera-debuginfo-26.4.11-1.el7.ppc64le.rpm
rh-mariadb105-mariadb-10.5.16-2.el7.ppc64le.rpm
rh-mariadb105-mariadb-backup-10.5.16-2.el7.ppc64le.rpm
rh-mariadb105-mariadb-backup-syspaths-10.5.16-2.el7.ppc64le.rpm
rh-mariadb105-mariadb-common-10.5.16-2.el7.ppc64le.rpm
rh-mariadb105-mariadb-config-10.5.16-2.el7.ppc64le.rpm
rh-mariadb105-mariadb-config-syspaths-10.5.16-2.el7.ppc64le.rpm
rh-mariadb105-mariadb-connect-engine-10.5.16-2.el7.ppc64le.rpm
rh-mariadb105-mariadb-debuginfo-10.5.16-2.el7.ppc64le.rpm
rh-mariadb105-mariadb-devel-10.5.16-2.el7.ppc64le.rpm
rh-mariadb105-mariadb-errmsg-10.5.16-2.el7.ppc64le.rpm
rh-mariadb105-mariadb-gssapi-server-10.5.16-2.el7.ppc64le.rpm
rh-mariadb105-mariadb-libs-10.5.16-2.el7.ppc64le.rpm
rh-mariadb105-mariadb-oqgraph-engine-10.5.16-2.el7.ppc64le.rpm
rh-mariadb105-mariadb-pam-10.5.16-2.el7.ppc64le.rpm
rh-mariadb105-mariadb-server-10.5.16-2.el7.ppc64le.rpm
rh-mariadb105-mariadb-server-galera-10.5.16-2.el7.ppc64le.rpm
rh-mariadb105-mariadb-server-galera-syspaths-10.5.16-2.el7.ppc64le.rpm
rh-mariadb105-mariadb-server-syspaths-10.5.16-2.el7.ppc64le.rpm
rh-mariadb105-mariadb-server-utils-10.5.16-2.el7.ppc64le.rpm
rh-mariadb105-mariadb-server-utils-syspaths-10.5.16-2.el7.ppc64le.rpm
rh-mariadb105-mariadb-syspaths-10.5.16-2.el7.ppc64le.rpm
rh-mariadb105-mariadb-test-10.5.16-2.el7.ppc64le.rpm
s390x:
rh-mariadb105-galera-26.4.11-1.el7.s390x.rpm
rh-mariadb105-galera-debuginfo-26.4.11-1.el7.s390x.rpm
rh-mariadb105-mariadb-10.5.16-2.el7.s390x.rpm
rh-mariadb105-mariadb-backup-10.5.16-2.el7.s390x.rpm
rh-mariadb105-mariadb-backup-syspaths-10.5.16-2.el7.s390x.rpm
rh-mariadb105-mariadb-common-10.5.16-2.el7.s390x.rpm
rh-mariadb105-mariadb-config-10.5.16-2.el7.s390x.rpm
rh-mariadb105-mariadb-config-syspaths-10.5.16-2.el7.s390x.rpm
rh-mariadb105-mariadb-connect-engine-10.5.16-2.el7.s390x.rpm
rh-mariadb105-mariadb-debuginfo-10.5.16-2.el7.s390x.rpm
rh-mariadb105-mariadb-devel-10.5.16-2.el7.s390x.rpm
rh-mariadb105-mariadb-errmsg-10.5.16-2.el7.s390x.rpm
rh-mariadb105-mariadb-gssapi-server-10.5.16-2.el7.s390x.rpm
rh-mariadb105-mariadb-libs-10.5.16-2.el7.s390x.rpm
rh-mariadb105-mariadb-oqgraph-engine-10.5.16-2.el7.s390x.rpm
rh-mariadb105-mariadb-pam-10.5.16-2.el7.s390x.rpm
rh-mariadb105-mariadb-server-10.5.16-2.el7.s390x.rpm
rh-mariadb105-mariadb-server-galera-10.5.16-2.el7.s390x.rpm
rh-mariadb105-mariadb-server-galera-syspaths-10.5.16-2.el7.s390x.rpm
rh-mariadb105-mariadb-server-syspaths-10.5.16-2.el7.s390x.rpm
rh-mariadb105-mariadb-server-utils-10.5.16-2.el7.s390x.rpm
rh-mariadb105-mariadb-server-utils-syspaths-10.5.16-2.el7.s390x.rpm
rh-mariadb105-mariadb-syspaths-10.5.16-2.el7.s390x.rpm
rh-mariadb105-mariadb-test-10.5.16-2.el7.s390x.rpm
x86_64:
rh-mariadb105-galera-26.4.11-1.el7.x86_64.rpm
rh-mariadb105-galera-debuginfo-26.4.11-1.el7.x86_64.rpm
rh-mariadb105-mariadb-10.5.16-2.el7.x86_64.rpm
rh-mariadb105-mariadb-backup-10.5.16-2.el7.x86_64.rpm
rh-mariadb105-mariadb-backup-syspaths-10.5.16-2.el7.x86_64.rpm
rh-mariadb105-mariadb-common-10.5.16-2.el7.x86_64.rpm
rh-mariadb105-mariadb-config-10.5.16-2.el7.x86_64.rpm
rh-mariadb105-mariadb-config-syspaths-10.5.16-2.el7.x86_64.rpm
rh-mariadb105-mariadb-connect-engine-10.5.16-2.el7.x86_64.rpm
rh-mariadb105-mariadb-debuginfo-10.5.16-2.el7.x86_64.rpm
rh-mariadb105-mariadb-devel-10.5.16-2.el7.x86_64.rpm
rh-mariadb105-mariadb-errmsg-10.5.16-2.el7.x86_64.rpm
rh-mariadb105-mariadb-gssapi-server-10.5.16-2.el7.x86_64.rpm
rh-mariadb105-mariadb-libs-10.5.16-2.el7.x86_64.rpm
rh-mariadb105-mariadb-oqgraph-engine-10.5.16-2.el7.x86_64.rpm
rh-mariadb105-mariadb-pam-10.5.16-2.el7.x86_64.rpm
rh-mariadb105-mariadb-server-10.5.16-2.el7.x86_64.rpm
rh-mariadb105-mariadb-server-galera-10.5.16-2.el7.x86_64.rpm
rh-mariadb105-mariadb-server-galera-syspaths-10.5.16-2.el7.x86_64.rpm
rh-mariadb105-mariadb-server-syspaths-10.5.16-2.el7.x86_64.rpm
rh-mariadb105-mariadb-server-utils-10.5.16-2.el7.x86_64.rpm
rh-mariadb105-mariadb-server-utils-syspaths-10.5.16-2.el7.x86_64.rpm
rh-mariadb105-mariadb-syspaths-10.5.16-2.el7.x86_64.rpm
rh-mariadb105-mariadb-test-10.5.16-2.el7.x86_64.rpm
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7):
Source:
rh-mariadb105-galera-26.4.11-1.el7.src.rpm
rh-mariadb105-mariadb-10.5.16-2.el7.src.rpm
x86_64:
rh-mariadb105-galera-26.4.11-1.el7.x86_64.rpm
rh-mariadb105-galera-debuginfo-26.4.11-1.el7.x86_64.rpm
rh-mariadb105-mariadb-10.5.16-2.el7.x86_64.rpm
rh-mariadb105-mariadb-backup-10.5.16-2.el7.x86_64.rpm
rh-mariadb105-mariadb-backup-syspaths-10.5.16-2.el7.x86_64.rpm
rh-mariadb105-mariadb-common-10.5.16-2.el7.x86_64.rpm
rh-mariadb105-mariadb-config-10.5.16-2.el7.x86_64.rpm
rh-mariadb105-mariadb-config-syspaths-10.5.16-2.el7.x86_64.rpm
rh-mariadb105-mariadb-connect-engine-10.5.16-2.el7.x86_64.rpm
rh-mariadb105-mariadb-debuginfo-10.5.16-2.el7.x86_64.rpm
rh-mariadb105-mariadb-devel-10.5.16-2.el7.x86_64.rpm
rh-mariadb105-mariadb-errmsg-10.5.16-2.el7.x86_64.rpm
rh-mariadb105-mariadb-gssapi-server-10.5.16-2.el7.x86_64.rpm
rh-mariadb105-mariadb-libs-10.5.16-2.el7.x86_64.rpm
rh-mariadb105-mariadb-oqgraph-engine-10.5.16-2.el7.x86_64.rpm
rh-mariadb105-mariadb-pam-10.5.16-2.el7.x86_64.rpm
rh-mariadb105-mariadb-server-10.5.16-2.el7.x86_64.rpm
rh-mariadb105-mariadb-server-galera-10.5.16-2.el7.x86_64.rpm
rh-mariadb105-mariadb-server-galera-syspaths-10.5.16-2.el7.x86_64.rpm
rh-mariadb105-mariadb-server-syspaths-10.5.16-2.el7.x86_64.rpm
rh-mariadb105-mariadb-server-utils-10.5.16-2.el7.x86_64.rpm
rh-mariadb105-mariadb-server-utils-syspaths-10.5.16-2.el7.x86_64.rpm
rh-mariadb105-mariadb-syspaths-10.5.16-2.el7.x86_64.rpm
rh-mariadb105-mariadb-test-10.5.16-2.el7.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
Topic
An update for rh-mariadb105-galera and rh-mariadb105-mariadb is nowavailable for Red Hat Software Collections.Red Hat Product Security has rated this update as having a security impactof Moderate. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.
Topic
Relevant Releases Architectures
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) - ppc64le, s390x, x86_64
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) - x86_64
Bugs Fixed
2049302 - CVE-2021-46659 mariadb: Crash executing query with VIEW, aggregate and subquery
2050017 - CVE-2021-46661 mariadb: MariaDB allows an application crash in find_field_in_tables and find_order_in_list via an unused common table expression (CTE)
2050022 - CVE-2021-46663 mariadb: MariaDB through 10.5.13 allows a ha_maria::extra application crash via certain SELECT statements
2050024 - CVE-2021-46664 mariadb: MariaDB through 10.5.9 allows an application crash in sub_select_postjoin_aggr for a NULL value of aggr
2050026 - CVE-2021-46665 mariadb: MariaDB through 10.5.9 allows a sql_parse.cc application crash because of incorrect used_tables expectations
2050032 - CVE-2021-46668 mariadb: MariaDB through 10.5.9 allows an application crash via certain long SELECT DISTINCT statements
2050034 - CVE-2021-46669 mariadb: MariaDB through 10.5.9 allows attackers to trigger a convert_const_to_int use-after-free when the BIGINT data type is used
2068211 - CVE-2022-24052 mariadb: CONNECT storage engine heap-based buffer overflow
2068233 - CVE-2022-24051 mariadb: lack of proper validation of a user-supplied string before using it as a format specifier
2068234 - CVE-2022-24048 mariadb: lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer
2069833 - CVE-2022-24050 mariadb: lack of validating the existence of an object prior to performing operations on the object
2074817 - CVE-2022-27376 mariadb: assertion failure in Item_args::walk_arg
2074947 - CVE-2022-27377 mariadb: use-after-poison when complex conversion is involved in blob
2074949 - CVE-2022-27378 mariadb: server crash in create_tmp_table::finalize
2074951 - CVE-2022-27379 mariadb: server crash in component arg_comparator::compare_real_fixed
2074966 - CVE-2022-27380 mariadb: server crash at my_decimal::operator2074981 - CVE-2022-27381 mariadb: server crash at Field::set_default via specially crafted SQL statements
2074987 - CVE-2022-27382 mariadb: assertion failure via component Item_field::used_tables/update_depend_map_for_order
2074996 - CVE-2022-27383 mariadb: use-after-poison in my_strcasecmp_8bit() of ctype-simple.c
2074999 - CVE-2022-27384 mariadb: crash via component Item_subselect::init_expr_cache_tracker
2075005 - CVE-2022-27386 mariadb: server crashes in query_arena::set_query_arena upon SELECT from view
2075006 - CVE-2022-27387 mariadb: assertion failures in decimal_bin_size
2075691 - CVE-2022-27445 mariadb: assertion failure in compare_order_elements
2075692 - CVE-2022-27446 mariadb: crash when using HAVING with IS NULL predicate in an equality
2075693 - CVE-2022-27447 mariadb: use-after-poison in Binary_string::free_buffer
2075694 - CVE-2022-27448 mariadb: crash in multi-update and implicit grouping
2075695 - CVE-2022-27449 mariadb: assertion failure in sql/item_func.cc
2075696 - CVE-2022-27444 mariadb: crash when using HAVING with NOT EXIST predicate in an equality
2075697 - CVE-2022-27456 mariadb: assertion failure in VDec::VDec at /sql/sql_type.cc
2075699 - CVE-2022-27457 mariadb: incorrect key in "dup value" error after long unique
2075700 - CVE-2022-27458 mariadb: use-after-poison in Binary_string::free_buffer
2075701 - CVE-2022-27455 mariadb: use-after-free when WHERE has subquery with an outer reference in HAVING
2076144 - CVE-2022-27451 mariadb: crash via window function in expression in ORDER BY
2076145 - CVE-2022-27452 mariadb: assertion failure in sql/item_cmpfunc.cc
2092354 - CVE-2022-31622 mariadb: improper locking due to the unreleased lock in extra/mariabackup/ds_compress.cc
2092360 - CVE-2022-31623 mariadb: improper locking due to the unreleased lock in extra/mariabackup/ds_compress.cc
2101776 - Don't use less parallelism if not necessary [rhscl-3.8.z]
2101777 - DROP TABLE doesn't raise error while dropping non-existing table [rhscl-3.8.z]
2101782 - [Tracker] Rebase to MariaDB 10.5.16 [rhscl-3.8.z]
2101783 - [Tracker] Rebase to Galera 26.4.11 [rhscl-3.8.z]
2104425 - CVE-2022-32083 mariadb: server crash at Item_subselect::init_expr_cache_tracker
2104431 - CVE-2022-32085 mariadb: server crash in Item_func_in::cleanup/Item::cleanup_processor
2104433 - CVE-2022-32086 mariadb: server crash in Item_field::fix_outer_field for INSERT SELECT
2104434 - CVE-2022-32087 mariadb: server crash in Item_args::walk_args
2106008 - CVE-2022-32088 mariadb: segmentation fault in Exec_time_tracker::get_loops/Filesort_tracker::report_use/filesort