-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

====================================================================                   Red Hat Security Advisory

Synopsis:          Moderate: rh-mariadb105-galera and rh-mariadb105-mariadb security and bugfix update
Advisory ID:       RHSA-2022:5759-01
Product:           Red Hat Software Collections
Advisory URL:      https://access.redhat.com/errata/RHSA-2022:5759
Issue date:        2022-07-28
CVE Names:         CVE-2021-46659 CVE-2021-46661 CVE-2021-46663 
                   CVE-2021-46664 CVE-2021-46665 CVE-2021-46668 
                   CVE-2021-46669 CVE-2022-24048 CVE-2022-24050 
                   CVE-2022-24051 CVE-2022-24052 CVE-2022-27376 
                   CVE-2022-27377 CVE-2022-27378 CVE-2022-27379 
                   CVE-2022-27380 CVE-2022-27381 CVE-2022-27382 
                   CVE-2022-27383 CVE-2022-27384 CVE-2022-27386 
                   CVE-2022-27387 CVE-2022-27444 CVE-2022-27445 
                   CVE-2022-27446 CVE-2022-27447 CVE-2022-27448 
                   CVE-2022-27449 CVE-2022-27451 CVE-2022-27452 
                   CVE-2022-27455 CVE-2022-27456 CVE-2022-27457 
                   CVE-2022-27458 CVE-2022-31622 CVE-2022-31623 
                   CVE-2022-32083 CVE-2022-32085 CVE-2022-32086 
                   CVE-2022-32087 CVE-2022-32088 
====================================================================
1. Summary:

An update for rh-mariadb105-galera and rh-mariadb105-mariadb is now
available for Red Hat Software Collections.

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) - ppc64le, s390x, x86_64
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) - x86_64

3. Description:

MariaDB is a multi-user, multi-threaded SQL database server. For all
practical purposes, MariaDB is binary-compatible with MySQL.

The following packages have been upgraded to a later upstream version:
rh-mariadb105-galera (26.4.11), rh-mariadb105-mariadb (10.5.16).

Security Fix(es):

* mariadb: convert_const_to_int use-after-free when the BIGINT data type is
used (CVE-2021-46669)

* mariadb: lack of proper validation of the length of user-supplied data
prior to copying it to a fixed-length stack-based buffer (CVE-2022-24048)

* mariadb: lack of validating the existence of an object prior to
performing operations on the object (CVE-2022-24050)

* mariadb: lack of proper validation of a user-supplied string before using
it as a format specifier (CVE-2022-24051)

* mariadb: CONNECT storage engine heap-based buffer overflow
(CVE-2022-24052)

* mariadb: assertion failure in Item_args::walk_arg (CVE-2022-27376)

* mariadb: use-after-poison when complex conversion is involved in blob
(CVE-2022-27377)

* mariadb: crash in create_tmp_table::finalize (CVE-2022-27378)

* mariadb: crash in arg_comparator::compare_real_fixed (CVE-2022-27379)

* mariadb: crash at my_decimal::operator= (CVE-2022-27380)

* mariadb: crash at Field::set_default via specially crafted SQL statements
(CVE-2022-27381)

* mariadb: assertion failure via
Item_field::used_tables/update_depend_map_for_order (CVE-2022-27382)

* mariadb: use-after-poison in my_strcasecmp_8bit() of ctype-simple.c
(CVE-2022-27383)

* mariadb: crash via Item_subselect::init_expr_cache_tracker
(CVE-2022-27384)

* mariadb: crashe in query_arena::set_query_arena upon SELECT from view
(CVE-2022-27386)

* mariadb: assertion failures in decimal_bin_size (CVE-2022-27387)

* mariadb: crash when using HAVING with NOT EXIST predicate in an equality
(CVE-2022-27444)

* mariadb: assertion failure in compare_order_elements (CVE-2022-27445)

* mariadb: crash when using HAVING with IS NULL predicate in an equality
(CVE-2022-27446)

* mariadb: use-after-poison in Binary_string::free_buffer (CVE-2022-27447)

* mariadb: crash in multi-update and implicit grouping (CVE-2022-27448)

* mariadb: assertion failure in sql/item_func.cc (CVE-2022-27449)

* mariadb: crash via window function in expression in ORDER BY
(CVE-2022-27451)

* mariadb: assertion failure in sql/item_cmpfunc.cc (CVE-2022-27452)

* mariadb: use-after-free when WHERE has subquery with an outer reference
in HAVING (CVE-2022-27455)

* mariadb: assertion failure in VDec::VDec at /sql/sql_type.cc
(CVE-2022-27456)

* mariadb: incorrect key in "dup value" error after long unique
(CVE-2022-27457)

* mariadb: use-after-poison in Binary_string::free_buffer (CVE-2022-27458)

* mariadb: improper locking in ds_compress.cc (CVE-2022-31622)

* mariadb: improper locking in ds_compress.cc (CVE-2022-31623)

* mariadb: crash at init_expr_cache_tracker (CVE-2022-32083)

* mariadb: crash in cleanup/Item::cleanup_processor (CVE-2022-32085)

* mariadb: crash in fix_outer_field for INSERT SELECT (CVE-2022-32086)

* mariadb: crash in Item_args::walk_args (CVE-2022-32087)

* mariadb: segmentation fault in get_loops/report_use/filesort
(CVE-2022-32088)

* mariadb: crash executing query with VIEW, aggregate and subquery
(CVE-2021-46659)

* mariadb: crash via an unused common table expression (CTE)
(CVE-2021-46661)

* mariadb: ha_maria::extra crash via certain SELECT statements
(CVE-2021-46663)

* mariadb: crash in sub_select_postjoin_aggr for a NULL value of aggr
(CVE-2021-46664)

* mariadb: sql_parse.cc crash because of used_tables expectations
(CVE-2021-46665)

* mariadb: application crash via long SELECT DISTINCT statements
(CVE-2021-46668)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

Bug Fix(es):

* Don't use less parallelism if not necessary (BZ#2101776)

* [Tracker] Rebase to Galera 26.4.11 (BZ#2101783)

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MariaDB server daemon (mysqld) will be
restarted automatically.

5. Bugs fixed (https://bugzilla.redhat.com/):

2049302 - CVE-2021-46659 mariadb: Crash executing query with VIEW, aggregate and subquery
2050017 - CVE-2021-46661 mariadb: MariaDB allows an application crash in find_field_in_tables and find_order_in_list via an unused common table expression (CTE)
2050022 - CVE-2021-46663 mariadb: MariaDB through 10.5.13 allows a ha_maria::extra application crash via certain SELECT statements
2050024 - CVE-2021-46664 mariadb: MariaDB through 10.5.9 allows an application crash in sub_select_postjoin_aggr for a NULL value of aggr
2050026 - CVE-2021-46665 mariadb: MariaDB through 10.5.9 allows a sql_parse.cc application crash because of incorrect used_tables expectations
2050032 - CVE-2021-46668 mariadb: MariaDB through 10.5.9 allows an application crash via certain long SELECT DISTINCT statements
2050034 - CVE-2021-46669 mariadb: MariaDB through 10.5.9 allows attackers to trigger a convert_const_to_int use-after-free when the BIGINT data type is used
2068211 - CVE-2022-24052 mariadb: CONNECT storage engine heap-based buffer overflow
2068233 - CVE-2022-24051 mariadb: lack of proper validation of a user-supplied string before using it as a format specifier
2068234 - CVE-2022-24048 mariadb: lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer
2069833 - CVE-2022-24050 mariadb: lack of validating the existence of an object prior to performing operations on the object
2074817 - CVE-2022-27376 mariadb: assertion failure in Item_args::walk_arg
2074947 - CVE-2022-27377 mariadb: use-after-poison when complex conversion is involved in blob
2074949 - CVE-2022-27378 mariadb: server crash in create_tmp_table::finalize
2074951 - CVE-2022-27379 mariadb: server crash in component arg_comparator::compare_real_fixed
2074966 - CVE-2022-27380 mariadb: server crash at my_decimal::operator2074981 - CVE-2022-27381 mariadb: server crash at Field::set_default via specially crafted SQL statements
2074987 - CVE-2022-27382 mariadb: assertion failure via component Item_field::used_tables/update_depend_map_for_order
2074996 - CVE-2022-27383 mariadb: use-after-poison in my_strcasecmp_8bit() of ctype-simple.c
2074999 - CVE-2022-27384 mariadb: crash via component Item_subselect::init_expr_cache_tracker
2075005 - CVE-2022-27386 mariadb: server crashes in query_arena::set_query_arena upon SELECT from view
2075006 - CVE-2022-27387 mariadb: assertion failures in decimal_bin_size
2075691 - CVE-2022-27445 mariadb: assertion failure in compare_order_elements
2075692 - CVE-2022-27446 mariadb: crash when using HAVING with IS NULL predicate in an equality
2075693 - CVE-2022-27447 mariadb: use-after-poison in Binary_string::free_buffer
2075694 - CVE-2022-27448 mariadb: crash in multi-update and implicit grouping
2075695 - CVE-2022-27449 mariadb: assertion failure in sql/item_func.cc
2075696 - CVE-2022-27444 mariadb: crash when using HAVING with NOT EXIST predicate in an equality
2075697 - CVE-2022-27456 mariadb: assertion failure in VDec::VDec at /sql/sql_type.cc
2075699 - CVE-2022-27457 mariadb: incorrect key in "dup value" error after long unique
2075700 - CVE-2022-27458 mariadb: use-after-poison in Binary_string::free_buffer
2075701 - CVE-2022-27455 mariadb: use-after-free when WHERE has subquery with an outer reference in HAVING
2076144 - CVE-2022-27451 mariadb: crash via window function in expression in ORDER BY
2076145 - CVE-2022-27452 mariadb: assertion failure in sql/item_cmpfunc.cc
2092354 - CVE-2022-31622 mariadb: improper locking due to the unreleased lock in extra/mariabackup/ds_compress.cc
2092360 - CVE-2022-31623 mariadb: improper locking due to the unreleased lock in extra/mariabackup/ds_compress.cc
2101776 - Don't use less parallelism if not necessary [rhscl-3.8.z]
2101777 - DROP TABLE doesn't raise error while dropping non-existing table [rhscl-3.8.z]
2101782 - [Tracker] Rebase to MariaDB 10.5.16 [rhscl-3.8.z]
2101783 - [Tracker] Rebase to Galera 26.4.11 [rhscl-3.8.z]
2104425 - CVE-2022-32083 mariadb: server crash at Item_subselect::init_expr_cache_tracker
2104431 - CVE-2022-32085 mariadb: server crash in Item_func_in::cleanup/Item::cleanup_processor
2104433 - CVE-2022-32086 mariadb: server crash in Item_field::fix_outer_field for INSERT SELECT
2104434 - CVE-2022-32087 mariadb: server crash in Item_args::walk_args
2106008 - CVE-2022-32088 mariadb: segmentation fault in Exec_time_tracker::get_loops/Filesort_tracker::report_use/filesort

6. Package List:

Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7):

Source:
rh-mariadb105-galera-26.4.11-1.el7.src.rpm
rh-mariadb105-mariadb-10.5.16-2.el7.src.rpm

ppc64le:
rh-mariadb105-galera-26.4.11-1.el7.ppc64le.rpm
rh-mariadb105-galera-debuginfo-26.4.11-1.el7.ppc64le.rpm
rh-mariadb105-mariadb-10.5.16-2.el7.ppc64le.rpm
rh-mariadb105-mariadb-backup-10.5.16-2.el7.ppc64le.rpm
rh-mariadb105-mariadb-backup-syspaths-10.5.16-2.el7.ppc64le.rpm
rh-mariadb105-mariadb-common-10.5.16-2.el7.ppc64le.rpm
rh-mariadb105-mariadb-config-10.5.16-2.el7.ppc64le.rpm
rh-mariadb105-mariadb-config-syspaths-10.5.16-2.el7.ppc64le.rpm
rh-mariadb105-mariadb-connect-engine-10.5.16-2.el7.ppc64le.rpm
rh-mariadb105-mariadb-debuginfo-10.5.16-2.el7.ppc64le.rpm
rh-mariadb105-mariadb-devel-10.5.16-2.el7.ppc64le.rpm
rh-mariadb105-mariadb-errmsg-10.5.16-2.el7.ppc64le.rpm
rh-mariadb105-mariadb-gssapi-server-10.5.16-2.el7.ppc64le.rpm
rh-mariadb105-mariadb-libs-10.5.16-2.el7.ppc64le.rpm
rh-mariadb105-mariadb-oqgraph-engine-10.5.16-2.el7.ppc64le.rpm
rh-mariadb105-mariadb-pam-10.5.16-2.el7.ppc64le.rpm
rh-mariadb105-mariadb-server-10.5.16-2.el7.ppc64le.rpm
rh-mariadb105-mariadb-server-galera-10.5.16-2.el7.ppc64le.rpm
rh-mariadb105-mariadb-server-galera-syspaths-10.5.16-2.el7.ppc64le.rpm
rh-mariadb105-mariadb-server-syspaths-10.5.16-2.el7.ppc64le.rpm
rh-mariadb105-mariadb-server-utils-10.5.16-2.el7.ppc64le.rpm
rh-mariadb105-mariadb-server-utils-syspaths-10.5.16-2.el7.ppc64le.rpm
rh-mariadb105-mariadb-syspaths-10.5.16-2.el7.ppc64le.rpm
rh-mariadb105-mariadb-test-10.5.16-2.el7.ppc64le.rpm

s390x:
rh-mariadb105-galera-26.4.11-1.el7.s390x.rpm
rh-mariadb105-galera-debuginfo-26.4.11-1.el7.s390x.rpm
rh-mariadb105-mariadb-10.5.16-2.el7.s390x.rpm
rh-mariadb105-mariadb-backup-10.5.16-2.el7.s390x.rpm
rh-mariadb105-mariadb-backup-syspaths-10.5.16-2.el7.s390x.rpm
rh-mariadb105-mariadb-common-10.5.16-2.el7.s390x.rpm
rh-mariadb105-mariadb-config-10.5.16-2.el7.s390x.rpm
rh-mariadb105-mariadb-config-syspaths-10.5.16-2.el7.s390x.rpm
rh-mariadb105-mariadb-connect-engine-10.5.16-2.el7.s390x.rpm
rh-mariadb105-mariadb-debuginfo-10.5.16-2.el7.s390x.rpm
rh-mariadb105-mariadb-devel-10.5.16-2.el7.s390x.rpm
rh-mariadb105-mariadb-errmsg-10.5.16-2.el7.s390x.rpm
rh-mariadb105-mariadb-gssapi-server-10.5.16-2.el7.s390x.rpm
rh-mariadb105-mariadb-libs-10.5.16-2.el7.s390x.rpm
rh-mariadb105-mariadb-oqgraph-engine-10.5.16-2.el7.s390x.rpm
rh-mariadb105-mariadb-pam-10.5.16-2.el7.s390x.rpm
rh-mariadb105-mariadb-server-10.5.16-2.el7.s390x.rpm
rh-mariadb105-mariadb-server-galera-10.5.16-2.el7.s390x.rpm
rh-mariadb105-mariadb-server-galera-syspaths-10.5.16-2.el7.s390x.rpm
rh-mariadb105-mariadb-server-syspaths-10.5.16-2.el7.s390x.rpm
rh-mariadb105-mariadb-server-utils-10.5.16-2.el7.s390x.rpm
rh-mariadb105-mariadb-server-utils-syspaths-10.5.16-2.el7.s390x.rpm
rh-mariadb105-mariadb-syspaths-10.5.16-2.el7.s390x.rpm
rh-mariadb105-mariadb-test-10.5.16-2.el7.s390x.rpm

x86_64:
rh-mariadb105-galera-26.4.11-1.el7.x86_64.rpm
rh-mariadb105-galera-debuginfo-26.4.11-1.el7.x86_64.rpm
rh-mariadb105-mariadb-10.5.16-2.el7.x86_64.rpm
rh-mariadb105-mariadb-backup-10.5.16-2.el7.x86_64.rpm
rh-mariadb105-mariadb-backup-syspaths-10.5.16-2.el7.x86_64.rpm
rh-mariadb105-mariadb-common-10.5.16-2.el7.x86_64.rpm
rh-mariadb105-mariadb-config-10.5.16-2.el7.x86_64.rpm
rh-mariadb105-mariadb-config-syspaths-10.5.16-2.el7.x86_64.rpm
rh-mariadb105-mariadb-connect-engine-10.5.16-2.el7.x86_64.rpm
rh-mariadb105-mariadb-debuginfo-10.5.16-2.el7.x86_64.rpm
rh-mariadb105-mariadb-devel-10.5.16-2.el7.x86_64.rpm
rh-mariadb105-mariadb-errmsg-10.5.16-2.el7.x86_64.rpm
rh-mariadb105-mariadb-gssapi-server-10.5.16-2.el7.x86_64.rpm
rh-mariadb105-mariadb-libs-10.5.16-2.el7.x86_64.rpm
rh-mariadb105-mariadb-oqgraph-engine-10.5.16-2.el7.x86_64.rpm
rh-mariadb105-mariadb-pam-10.5.16-2.el7.x86_64.rpm
rh-mariadb105-mariadb-server-10.5.16-2.el7.x86_64.rpm
rh-mariadb105-mariadb-server-galera-10.5.16-2.el7.x86_64.rpm
rh-mariadb105-mariadb-server-galera-syspaths-10.5.16-2.el7.x86_64.rpm
rh-mariadb105-mariadb-server-syspaths-10.5.16-2.el7.x86_64.rpm
rh-mariadb105-mariadb-server-utils-10.5.16-2.el7.x86_64.rpm
rh-mariadb105-mariadb-server-utils-syspaths-10.5.16-2.el7.x86_64.rpm
rh-mariadb105-mariadb-syspaths-10.5.16-2.el7.x86_64.rpm
rh-mariadb105-mariadb-test-10.5.16-2.el7.x86_64.rpm

Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7):

Source:
rh-mariadb105-galera-26.4.11-1.el7.src.rpm
rh-mariadb105-mariadb-10.5.16-2.el7.src.rpm

x86_64:
rh-mariadb105-galera-26.4.11-1.el7.x86_64.rpm
rh-mariadb105-galera-debuginfo-26.4.11-1.el7.x86_64.rpm
rh-mariadb105-mariadb-10.5.16-2.el7.x86_64.rpm
rh-mariadb105-mariadb-backup-10.5.16-2.el7.x86_64.rpm
rh-mariadb105-mariadb-backup-syspaths-10.5.16-2.el7.x86_64.rpm
rh-mariadb105-mariadb-common-10.5.16-2.el7.x86_64.rpm
rh-mariadb105-mariadb-config-10.5.16-2.el7.x86_64.rpm
rh-mariadb105-mariadb-config-syspaths-10.5.16-2.el7.x86_64.rpm
rh-mariadb105-mariadb-connect-engine-10.5.16-2.el7.x86_64.rpm
rh-mariadb105-mariadb-debuginfo-10.5.16-2.el7.x86_64.rpm
rh-mariadb105-mariadb-devel-10.5.16-2.el7.x86_64.rpm
rh-mariadb105-mariadb-errmsg-10.5.16-2.el7.x86_64.rpm
rh-mariadb105-mariadb-gssapi-server-10.5.16-2.el7.x86_64.rpm
rh-mariadb105-mariadb-libs-10.5.16-2.el7.x86_64.rpm
rh-mariadb105-mariadb-oqgraph-engine-10.5.16-2.el7.x86_64.rpm
rh-mariadb105-mariadb-pam-10.5.16-2.el7.x86_64.rpm
rh-mariadb105-mariadb-server-10.5.16-2.el7.x86_64.rpm
rh-mariadb105-mariadb-server-galera-10.5.16-2.el7.x86_64.rpm
rh-mariadb105-mariadb-server-galera-syspaths-10.5.16-2.el7.x86_64.rpm
rh-mariadb105-mariadb-server-syspaths-10.5.16-2.el7.x86_64.rpm
rh-mariadb105-mariadb-server-utils-10.5.16-2.el7.x86_64.rpm
rh-mariadb105-mariadb-server-utils-syspaths-10.5.16-2.el7.x86_64.rpm
rh-mariadb105-mariadb-syspaths-10.5.16-2.el7.x86_64.rpm
rh-mariadb105-mariadb-test-10.5.16-2.el7.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2021-46659
https://access.redhat.com/security/cve/CVE-2021-46661
https://access.redhat.com/security/cve/CVE-2021-46663
https://access.redhat.com/security/cve/CVE-2021-46664
https://access.redhat.com/security/cve/CVE-2021-46665
https://access.redhat.com/security/cve/CVE-2021-46668
https://access.redhat.com/security/cve/CVE-2021-46669
https://access.redhat.com/security/cve/CVE-2022-24048
https://access.redhat.com/security/cve/CVE-2022-24050
https://access.redhat.com/security/cve/CVE-2022-24051
https://access.redhat.com/security/cve/CVE-2022-24052
https://access.redhat.com/security/cve/CVE-2022-27376
https://access.redhat.com/security/cve/CVE-2022-27377
https://access.redhat.com/security/cve/CVE-2022-27378
https://access.redhat.com/security/cve/CVE-2022-27379
https://access.redhat.com/security/cve/CVE-2022-27380
https://access.redhat.com/security/cve/CVE-2022-27381
https://access.redhat.com/security/cve/CVE-2022-27382
https://access.redhat.com/security/cve/CVE-2022-27383
https://access.redhat.com/security/cve/CVE-2022-27384
https://access.redhat.com/security/cve/CVE-2022-27386
https://access.redhat.com/security/cve/CVE-2022-27387
https://access.redhat.com/security/cve/CVE-2022-27444
https://access.redhat.com/security/cve/CVE-2022-27445
https://access.redhat.com/security/cve/CVE-2022-27446
https://access.redhat.com/security/cve/CVE-2022-27447
https://access.redhat.com/security/cve/CVE-2022-27448
https://access.redhat.com/security/cve/CVE-2022-27449
https://access.redhat.com/security/cve/CVE-2022-27451
https://access.redhat.com/security/cve/CVE-2022-27452
https://access.redhat.com/security/cve/CVE-2022-27455
https://access.redhat.com/security/cve/CVE-2022-27456
https://access.redhat.com/security/cve/CVE-2022-27457
https://access.redhat.com/security/cve/CVE-2022-27458
https://access.redhat.com/security/cve/CVE-2022-31622
https://access.redhat.com/security/cve/CVE-2022-31623
https://access.redhat.com/security/cve/CVE-2022-32083
https://access.redhat.com/security/cve/CVE-2022-32085
https://access.redhat.com/security/cve/CVE-2022-32086
https://access.redhat.com/security/cve/CVE-2022-32087
https://access.redhat.com/security/cve/CVE-2022-32088
https://access.redhat.com/security/updates/classification/#moderate

8. Contact:

The Red Hat security contact is . More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBYuqtMNzjgjWX9erEAQjKlA/9FUX2h/uVu+3/LWYDxTucY//B3eYAYcb8
a4MPPvMIvXlFaQdVRnO6mq9vEJNiRJxE+57nLuxAuxjXGescZWdC8UZouccgrS4P
oTQxSkvmSIEdIPfA5bYv2/TxJqLAgG4Y1PU6qboC/sZlgs0QiLbHOsoUJIp5C9S8
J6IkzGbYVJBZFSuNUYzdeFVY4MUus8hUbEnZbUEO2OrGw50aCxX3lbhcjMm5oBjm
XyiTOxFUdK+rPfi69+8g1GUtTsrEarCYUTUlojynO3DIGWH2EkGEd7bqhTWib0HQ
cmtWRir6CU6N8CZSNYTJkdBnn4y98ZVs10eLHDrH592IQqjFX+WT8dUMffmtyO6C
jpPbxC1qwyEMMOD2b4pmvNUOPMccXjm78ABw3e+jKrJygGfId/dLjUMHosMO4hz3
LQm/rx5yvODKsYR74rrBvuSl0artielALd78nidTcx87pxsDjIYCo4NuAOAIoe0f
Oj/R0XUXzoYBEV/S75tUox/KzmTv/xxze4doDYfOZWUYQhHOD+SYCN/Z2HRmPK3/
U+LJ1COUXvPiLBauJhYSeUSPEjhlGWI04zJtNy8BEKSAG2ofnw7a/MpH1ZP48Yj0
qp8laqrIBaeDZKGMIzY8+f0KoU4MJTZjt7UN2+y2SdRiDQZnmuAWn6JF5EUeLGRj
BQdEOLAbGFw=RKEO
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://listman.redhat.com/mailman/listinfo/rhsa-announce

RedHat: RHSA-2022-5759:01 Moderate: rh-mariadb105-galera and

An update for rh-mariadb105-galera and rh-mariadb105-mariadb is now available for Red Hat Software Collections

Summary

MariaDB is a multi-user, multi-threaded SQL database server. For all practical purposes, MariaDB is binary-compatible with MySQL.
The following packages have been upgraded to a later upstream version: rh-mariadb105-galera (26.4.11), rh-mariadb105-mariadb (10.5.16).
Security Fix(es):
* mariadb: convert_const_to_int use-after-free when the BIGINT data type is used (CVE-2021-46669)
* mariadb: lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer (CVE-2022-24048)
* mariadb: lack of validating the existence of an object prior to performing operations on the object (CVE-2022-24050)
* mariadb: lack of proper validation of a user-supplied string before using it as a format specifier (CVE-2022-24051)
* mariadb: CONNECT storage engine heap-based buffer overflow (CVE-2022-24052)
* mariadb: assertion failure in Item_args::walk_arg (CVE-2022-27376)
* mariadb: use-after-poison when complex conversion is involved in blob (CVE-2022-27377)
* mariadb: crash in create_tmp_table::finalize (CVE-2022-27378)
* mariadb: crash in arg_comparator::compare_real_fixed (CVE-2022-27379)
* mariadb: crash at my_decimal::operator= (CVE-2022-27380)
* mariadb: crash at Field::set_default via specially crafted SQL statements (CVE-2022-27381)
* mariadb: assertion failure via Item_field::used_tables/update_depend_map_for_order (CVE-2022-27382)
* mariadb: use-after-poison in my_strcasecmp_8bit() of ctype-simple.c (CVE-2022-27383)
* mariadb: crash via Item_subselect::init_expr_cache_tracker (CVE-2022-27384)
* mariadb: crashe in query_arena::set_query_arena upon SELECT from view (CVE-2022-27386)
* mariadb: assertion failures in decimal_bin_size (CVE-2022-27387)
* mariadb: crash when using HAVING with NOT EXIST predicate in an equality (CVE-2022-27444)
* mariadb: assertion failure in compare_order_elements (CVE-2022-27445)
* mariadb: crash when using HAVING with IS NULL predicate in an equality (CVE-2022-27446)
* mariadb: use-after-poison in Binary_string::free_buffer (CVE-2022-27447)
* mariadb: crash in multi-update and implicit grouping (CVE-2022-27448)
* mariadb: assertion failure in sql/item_func.cc (CVE-2022-27449)
* mariadb: crash via window function in expression in ORDER BY (CVE-2022-27451)
* mariadb: assertion failure in sql/item_cmpfunc.cc (CVE-2022-27452)
* mariadb: use-after-free when WHERE has subquery with an outer reference in HAVING (CVE-2022-27455)
* mariadb: assertion failure in VDec::VDec at /sql/sql_type.cc (CVE-2022-27456)
* mariadb: incorrect key in "dup value" error after long unique (CVE-2022-27457)
* mariadb: use-after-poison in Binary_string::free_buffer (CVE-2022-27458)
* mariadb: improper locking in ds_compress.cc (CVE-2022-31622)
* mariadb: improper locking in ds_compress.cc (CVE-2022-31623)
* mariadb: crash at init_expr_cache_tracker (CVE-2022-32083)
* mariadb: crash in cleanup/Item::cleanup_processor (CVE-2022-32085)
* mariadb: crash in fix_outer_field for INSERT SELECT (CVE-2022-32086)
* mariadb: crash in Item_args::walk_args (CVE-2022-32087)
* mariadb: segmentation fault in get_loops/report_use/filesort (CVE-2022-32088)
* mariadb: crash executing query with VIEW, aggregate and subquery (CVE-2021-46659)
* mariadb: crash via an unused common table expression (CTE) (CVE-2021-46661)
* mariadb: ha_maria::extra crash via certain SELECT statements (CVE-2021-46663)
* mariadb: crash in sub_select_postjoin_aggr for a NULL value of aggr (CVE-2021-46664)
* mariadb: sql_parse.cc crash because of used_tables expectations (CVE-2021-46665)
* mariadb: application crash via long SELECT DISTINCT statements (CVE-2021-46668)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Bug Fix(es):
* Don't use less parallelism if not necessary (BZ#2101776)
* [Tracker] Rebase to Galera 26.4.11 (BZ#2101783)



Summary


Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
After installing this update, the MariaDB server daemon (mysqld) will be restarted automatically.

References

https://access.redhat.com/security/cve/CVE-2021-46659 https://access.redhat.com/security/cve/CVE-2021-46661 https://access.redhat.com/security/cve/CVE-2021-46663 https://access.redhat.com/security/cve/CVE-2021-46664 https://access.redhat.com/security/cve/CVE-2021-46665 https://access.redhat.com/security/cve/CVE-2021-46668 https://access.redhat.com/security/cve/CVE-2021-46669 https://access.redhat.com/security/cve/CVE-2022-24048 https://access.redhat.com/security/cve/CVE-2022-24050 https://access.redhat.com/security/cve/CVE-2022-24051 https://access.redhat.com/security/cve/CVE-2022-24052 https://access.redhat.com/security/cve/CVE-2022-27376 https://access.redhat.com/security/cve/CVE-2022-27377 https://access.redhat.com/security/cve/CVE-2022-27378 https://access.redhat.com/security/cve/CVE-2022-27379 https://access.redhat.com/security/cve/CVE-2022-27380 https://access.redhat.com/security/cve/CVE-2022-27381 https://access.redhat.com/security/cve/CVE-2022-27382 https://access.redhat.com/security/cve/CVE-2022-27383 https://access.redhat.com/security/cve/CVE-2022-27384 https://access.redhat.com/security/cve/CVE-2022-27386 https://access.redhat.com/security/cve/CVE-2022-27387 https://access.redhat.com/security/cve/CVE-2022-27444 https://access.redhat.com/security/cve/CVE-2022-27445 https://access.redhat.com/security/cve/CVE-2022-27446 https://access.redhat.com/security/cve/CVE-2022-27447 https://access.redhat.com/security/cve/CVE-2022-27448 https://access.redhat.com/security/cve/CVE-2022-27449 https://access.redhat.com/security/cve/CVE-2022-27451 https://access.redhat.com/security/cve/CVE-2022-27452 https://access.redhat.com/security/cve/CVE-2022-27455 https://access.redhat.com/security/cve/CVE-2022-27456 https://access.redhat.com/security/cve/CVE-2022-27457 https://access.redhat.com/security/cve/CVE-2022-27458 https://access.redhat.com/security/cve/CVE-2022-31622 https://access.redhat.com/security/cve/CVE-2022-31623 https://access.redhat.com/security/cve/CVE-2022-32083 https://access.redhat.com/security/cve/CVE-2022-32085 https://access.redhat.com/security/cve/CVE-2022-32086 https://access.redhat.com/security/cve/CVE-2022-32087 https://access.redhat.com/security/cve/CVE-2022-32088 https://access.redhat.com/security/updates/classification/#moderate

Package List

Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7):
Source: rh-mariadb105-galera-26.4.11-1.el7.src.rpm rh-mariadb105-mariadb-10.5.16-2.el7.src.rpm
ppc64le: rh-mariadb105-galera-26.4.11-1.el7.ppc64le.rpm rh-mariadb105-galera-debuginfo-26.4.11-1.el7.ppc64le.rpm rh-mariadb105-mariadb-10.5.16-2.el7.ppc64le.rpm rh-mariadb105-mariadb-backup-10.5.16-2.el7.ppc64le.rpm rh-mariadb105-mariadb-backup-syspaths-10.5.16-2.el7.ppc64le.rpm rh-mariadb105-mariadb-common-10.5.16-2.el7.ppc64le.rpm rh-mariadb105-mariadb-config-10.5.16-2.el7.ppc64le.rpm rh-mariadb105-mariadb-config-syspaths-10.5.16-2.el7.ppc64le.rpm rh-mariadb105-mariadb-connect-engine-10.5.16-2.el7.ppc64le.rpm rh-mariadb105-mariadb-debuginfo-10.5.16-2.el7.ppc64le.rpm rh-mariadb105-mariadb-devel-10.5.16-2.el7.ppc64le.rpm rh-mariadb105-mariadb-errmsg-10.5.16-2.el7.ppc64le.rpm rh-mariadb105-mariadb-gssapi-server-10.5.16-2.el7.ppc64le.rpm rh-mariadb105-mariadb-libs-10.5.16-2.el7.ppc64le.rpm rh-mariadb105-mariadb-oqgraph-engine-10.5.16-2.el7.ppc64le.rpm rh-mariadb105-mariadb-pam-10.5.16-2.el7.ppc64le.rpm rh-mariadb105-mariadb-server-10.5.16-2.el7.ppc64le.rpm rh-mariadb105-mariadb-server-galera-10.5.16-2.el7.ppc64le.rpm rh-mariadb105-mariadb-server-galera-syspaths-10.5.16-2.el7.ppc64le.rpm rh-mariadb105-mariadb-server-syspaths-10.5.16-2.el7.ppc64le.rpm rh-mariadb105-mariadb-server-utils-10.5.16-2.el7.ppc64le.rpm rh-mariadb105-mariadb-server-utils-syspaths-10.5.16-2.el7.ppc64le.rpm rh-mariadb105-mariadb-syspaths-10.5.16-2.el7.ppc64le.rpm rh-mariadb105-mariadb-test-10.5.16-2.el7.ppc64le.rpm
s390x: rh-mariadb105-galera-26.4.11-1.el7.s390x.rpm rh-mariadb105-galera-debuginfo-26.4.11-1.el7.s390x.rpm rh-mariadb105-mariadb-10.5.16-2.el7.s390x.rpm rh-mariadb105-mariadb-backup-10.5.16-2.el7.s390x.rpm rh-mariadb105-mariadb-backup-syspaths-10.5.16-2.el7.s390x.rpm rh-mariadb105-mariadb-common-10.5.16-2.el7.s390x.rpm rh-mariadb105-mariadb-config-10.5.16-2.el7.s390x.rpm rh-mariadb105-mariadb-config-syspaths-10.5.16-2.el7.s390x.rpm rh-mariadb105-mariadb-connect-engine-10.5.16-2.el7.s390x.rpm rh-mariadb105-mariadb-debuginfo-10.5.16-2.el7.s390x.rpm rh-mariadb105-mariadb-devel-10.5.16-2.el7.s390x.rpm rh-mariadb105-mariadb-errmsg-10.5.16-2.el7.s390x.rpm rh-mariadb105-mariadb-gssapi-server-10.5.16-2.el7.s390x.rpm rh-mariadb105-mariadb-libs-10.5.16-2.el7.s390x.rpm rh-mariadb105-mariadb-oqgraph-engine-10.5.16-2.el7.s390x.rpm rh-mariadb105-mariadb-pam-10.5.16-2.el7.s390x.rpm rh-mariadb105-mariadb-server-10.5.16-2.el7.s390x.rpm rh-mariadb105-mariadb-server-galera-10.5.16-2.el7.s390x.rpm rh-mariadb105-mariadb-server-galera-syspaths-10.5.16-2.el7.s390x.rpm rh-mariadb105-mariadb-server-syspaths-10.5.16-2.el7.s390x.rpm rh-mariadb105-mariadb-server-utils-10.5.16-2.el7.s390x.rpm rh-mariadb105-mariadb-server-utils-syspaths-10.5.16-2.el7.s390x.rpm rh-mariadb105-mariadb-syspaths-10.5.16-2.el7.s390x.rpm rh-mariadb105-mariadb-test-10.5.16-2.el7.s390x.rpm
x86_64: rh-mariadb105-galera-26.4.11-1.el7.x86_64.rpm rh-mariadb105-galera-debuginfo-26.4.11-1.el7.x86_64.rpm rh-mariadb105-mariadb-10.5.16-2.el7.x86_64.rpm rh-mariadb105-mariadb-backup-10.5.16-2.el7.x86_64.rpm rh-mariadb105-mariadb-backup-syspaths-10.5.16-2.el7.x86_64.rpm rh-mariadb105-mariadb-common-10.5.16-2.el7.x86_64.rpm rh-mariadb105-mariadb-config-10.5.16-2.el7.x86_64.rpm rh-mariadb105-mariadb-config-syspaths-10.5.16-2.el7.x86_64.rpm rh-mariadb105-mariadb-connect-engine-10.5.16-2.el7.x86_64.rpm rh-mariadb105-mariadb-debuginfo-10.5.16-2.el7.x86_64.rpm rh-mariadb105-mariadb-devel-10.5.16-2.el7.x86_64.rpm rh-mariadb105-mariadb-errmsg-10.5.16-2.el7.x86_64.rpm rh-mariadb105-mariadb-gssapi-server-10.5.16-2.el7.x86_64.rpm rh-mariadb105-mariadb-libs-10.5.16-2.el7.x86_64.rpm rh-mariadb105-mariadb-oqgraph-engine-10.5.16-2.el7.x86_64.rpm rh-mariadb105-mariadb-pam-10.5.16-2.el7.x86_64.rpm rh-mariadb105-mariadb-server-10.5.16-2.el7.x86_64.rpm rh-mariadb105-mariadb-server-galera-10.5.16-2.el7.x86_64.rpm rh-mariadb105-mariadb-server-galera-syspaths-10.5.16-2.el7.x86_64.rpm rh-mariadb105-mariadb-server-syspaths-10.5.16-2.el7.x86_64.rpm rh-mariadb105-mariadb-server-utils-10.5.16-2.el7.x86_64.rpm rh-mariadb105-mariadb-server-utils-syspaths-10.5.16-2.el7.x86_64.rpm rh-mariadb105-mariadb-syspaths-10.5.16-2.el7.x86_64.rpm rh-mariadb105-mariadb-test-10.5.16-2.el7.x86_64.rpm
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7):
Source: rh-mariadb105-galera-26.4.11-1.el7.src.rpm rh-mariadb105-mariadb-10.5.16-2.el7.src.rpm
x86_64: rh-mariadb105-galera-26.4.11-1.el7.x86_64.rpm rh-mariadb105-galera-debuginfo-26.4.11-1.el7.x86_64.rpm rh-mariadb105-mariadb-10.5.16-2.el7.x86_64.rpm rh-mariadb105-mariadb-backup-10.5.16-2.el7.x86_64.rpm rh-mariadb105-mariadb-backup-syspaths-10.5.16-2.el7.x86_64.rpm rh-mariadb105-mariadb-common-10.5.16-2.el7.x86_64.rpm rh-mariadb105-mariadb-config-10.5.16-2.el7.x86_64.rpm rh-mariadb105-mariadb-config-syspaths-10.5.16-2.el7.x86_64.rpm rh-mariadb105-mariadb-connect-engine-10.5.16-2.el7.x86_64.rpm rh-mariadb105-mariadb-debuginfo-10.5.16-2.el7.x86_64.rpm rh-mariadb105-mariadb-devel-10.5.16-2.el7.x86_64.rpm rh-mariadb105-mariadb-errmsg-10.5.16-2.el7.x86_64.rpm rh-mariadb105-mariadb-gssapi-server-10.5.16-2.el7.x86_64.rpm rh-mariadb105-mariadb-libs-10.5.16-2.el7.x86_64.rpm rh-mariadb105-mariadb-oqgraph-engine-10.5.16-2.el7.x86_64.rpm rh-mariadb105-mariadb-pam-10.5.16-2.el7.x86_64.rpm rh-mariadb105-mariadb-server-10.5.16-2.el7.x86_64.rpm rh-mariadb105-mariadb-server-galera-10.5.16-2.el7.x86_64.rpm rh-mariadb105-mariadb-server-galera-syspaths-10.5.16-2.el7.x86_64.rpm rh-mariadb105-mariadb-server-syspaths-10.5.16-2.el7.x86_64.rpm rh-mariadb105-mariadb-server-utils-10.5.16-2.el7.x86_64.rpm rh-mariadb105-mariadb-server-utils-syspaths-10.5.16-2.el7.x86_64.rpm rh-mariadb105-mariadb-syspaths-10.5.16-2.el7.x86_64.rpm rh-mariadb105-mariadb-test-10.5.16-2.el7.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/


Severity
Advisory ID: RHSA-2022:5759-01
Product: Red Hat Software Collections
Advisory URL: https://access.redhat.com/errata/RHSA-2022:5759
Issued Date: : 2022-07-28
CVE Names: CVE-2021-46659 CVE-2021-46661 CVE-2021-46663 CVE-2021-46664 CVE-2021-46665 CVE-2021-46668 CVE-2021-46669 CVE-2022-24048 CVE-2022-24050 CVE-2022-24051 CVE-2022-24052 CVE-2022-27376 CVE-2022-27377 CVE-2022-27378 CVE-2022-27379 CVE-2022-27380 CVE-2022-27381 CVE-2022-27382 CVE-2022-27383 CVE-2022-27384 CVE-2022-27386 CVE-2022-27387 CVE-2022-27444 CVE-2022-27445 CVE-2022-27446 CVE-2022-27447 CVE-2022-27448 CVE-2022-27449 CVE-2022-27451 CVE-2022-27452 CVE-2022-27455 CVE-2022-27456 CVE-2022-27457 CVE-2022-27458 CVE-2022-31622 CVE-2022-31623 CVE-2022-32083 CVE-2022-32085 CVE-2022-32086 CVE-2022-32087 CVE-2022-32088

Topic

An update for rh-mariadb105-galera and rh-mariadb105-mariadb is nowavailable for Red Hat Software Collections.Red Hat Product Security has rated this update as having a security impactof Moderate. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.


Topic


 

Relevant Releases Architectures

Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) - ppc64le, s390x, x86_64

Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) - x86_64


Bugs Fixed

2049302 - CVE-2021-46659 mariadb: Crash executing query with VIEW, aggregate and subquery

2050017 - CVE-2021-46661 mariadb: MariaDB allows an application crash in find_field_in_tables and find_order_in_list via an unused common table expression (CTE)

2050022 - CVE-2021-46663 mariadb: MariaDB through 10.5.13 allows a ha_maria::extra application crash via certain SELECT statements

2050024 - CVE-2021-46664 mariadb: MariaDB through 10.5.9 allows an application crash in sub_select_postjoin_aggr for a NULL value of aggr

2050026 - CVE-2021-46665 mariadb: MariaDB through 10.5.9 allows a sql_parse.cc application crash because of incorrect used_tables expectations

2050032 - CVE-2021-46668 mariadb: MariaDB through 10.5.9 allows an application crash via certain long SELECT DISTINCT statements

2050034 - CVE-2021-46669 mariadb: MariaDB through 10.5.9 allows attackers to trigger a convert_const_to_int use-after-free when the BIGINT data type is used

2068211 - CVE-2022-24052 mariadb: CONNECT storage engine heap-based buffer overflow

2068233 - CVE-2022-24051 mariadb: lack of proper validation of a user-supplied string before using it as a format specifier

2068234 - CVE-2022-24048 mariadb: lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer

2069833 - CVE-2022-24050 mariadb: lack of validating the existence of an object prior to performing operations on the object

2074817 - CVE-2022-27376 mariadb: assertion failure in Item_args::walk_arg

2074947 - CVE-2022-27377 mariadb: use-after-poison when complex conversion is involved in blob

2074949 - CVE-2022-27378 mariadb: server crash in create_tmp_table::finalize

2074951 - CVE-2022-27379 mariadb: server crash in component arg_comparator::compare_real_fixed

2074966 - CVE-2022-27380 mariadb: server crash at my_decimal::operator2074981 - CVE-2022-27381 mariadb: server crash at Field::set_default via specially crafted SQL statements

2074987 - CVE-2022-27382 mariadb: assertion failure via component Item_field::used_tables/update_depend_map_for_order

2074996 - CVE-2022-27383 mariadb: use-after-poison in my_strcasecmp_8bit() of ctype-simple.c

2074999 - CVE-2022-27384 mariadb: crash via component Item_subselect::init_expr_cache_tracker

2075005 - CVE-2022-27386 mariadb: server crashes in query_arena::set_query_arena upon SELECT from view

2075006 - CVE-2022-27387 mariadb: assertion failures in decimal_bin_size

2075691 - CVE-2022-27445 mariadb: assertion failure in compare_order_elements

2075692 - CVE-2022-27446 mariadb: crash when using HAVING with IS NULL predicate in an equality

2075693 - CVE-2022-27447 mariadb: use-after-poison in Binary_string::free_buffer

2075694 - CVE-2022-27448 mariadb: crash in multi-update and implicit grouping

2075695 - CVE-2022-27449 mariadb: assertion failure in sql/item_func.cc

2075696 - CVE-2022-27444 mariadb: crash when using HAVING with NOT EXIST predicate in an equality

2075697 - CVE-2022-27456 mariadb: assertion failure in VDec::VDec at /sql/sql_type.cc

2075699 - CVE-2022-27457 mariadb: incorrect key in "dup value" error after long unique

2075700 - CVE-2022-27458 mariadb: use-after-poison in Binary_string::free_buffer

2075701 - CVE-2022-27455 mariadb: use-after-free when WHERE has subquery with an outer reference in HAVING

2076144 - CVE-2022-27451 mariadb: crash via window function in expression in ORDER BY

2076145 - CVE-2022-27452 mariadb: assertion failure in sql/item_cmpfunc.cc

2092354 - CVE-2022-31622 mariadb: improper locking due to the unreleased lock in extra/mariabackup/ds_compress.cc

2092360 - CVE-2022-31623 mariadb: improper locking due to the unreleased lock in extra/mariabackup/ds_compress.cc

2101776 - Don't use less parallelism if not necessary [rhscl-3.8.z]

2101777 - DROP TABLE doesn't raise error while dropping non-existing table [rhscl-3.8.z]

2101782 - [Tracker] Rebase to MariaDB 10.5.16 [rhscl-3.8.z]

2101783 - [Tracker] Rebase to Galera 26.4.11 [rhscl-3.8.z]

2104425 - CVE-2022-32083 mariadb: server crash at Item_subselect::init_expr_cache_tracker

2104431 - CVE-2022-32085 mariadb: server crash in Item_func_in::cleanup/Item::cleanup_processor

2104433 - CVE-2022-32086 mariadb: server crash in Item_field::fix_outer_field for INSERT SELECT

2104434 - CVE-2022-32087 mariadb: server crash in Item_args::walk_args

2106008 - CVE-2022-32088 mariadb: segmentation fault in Exec_time_tracker::get_loops/Filesort_tracker::report_use/filesort


Related News