The version of MariaDB installed on the remote host is prior to 10.5.14. It is, therefore, affected by multiple vulnerabilities as referenced in the 10.5.14 advisory.

  - MariaDB CONNECT Storage Engine Heap-based Buffer Overflow Privilege Escalation Vulnerability. This     vulnerability allows local attackers to escalate privileges on affected installations of MariaDB.
    Authentication is required to exploit this vulnerability. The specific flaw exists within the processing     of SQL queries. The issue results from the lack of proper validation of the length of user-supplied data     prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to     escalate privileges and execute arbitrary code in the context of the service account. Was ZDI-CAN-16190.
    (CVE-2022-24052)

  - MariaDB before 10.7.2 allows an application crash because it does not recognize that     SELECT_LEX::nest_level is local to each VIEW. (CVE-2021-46659)

  - The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop     forever for non-prime moduli. Internally this function is used when parsing certificates that contain     elliptic curve public keys in compressed form or explicit elliptic curve parameters with a base point     encoded in compressed form. It is possible to trigger the infinite loop by crafting a certificate that has     invalid explicit curve parameters. Since certificate parsing happens prior to verification of the     certificate signature, any process that parses an externally supplied certificate may thus be subject to a     denial of service attack. The infinite loop can also be reached when parsing crafted private keys as they     can contain explicit elliptic curve parameters. Thus vulnerable situations include: - TLS clients     consuming server certificates - TLS servers consuming client certificates - Hosting providers taking     certificates or private keys from customers - Certificate authorities parsing certification requests from     subscribers - Anything else which parses ASN.1 elliptic curve parameters Also any other applications that     use the BN_mod_sqrt() where the attacker can control the parameter values are vulnerable to this DoS     issue. In the OpenSSL 1.0.2 version the public key is not parsed during initial parsing of the certificate     which makes it slightly harder to trigger the infinite loop. However any operation which requires the     public key from the certificate will trigger the infinite loop. In particular the attacker can use a self-     signed certificate to trigger the loop during verification of the certificate signature. This issue     affects OpenSSL versions 1.0.2, 1.1.1 and 3.0. It was addressed in the releases of 1.1.1n and 3.0.2 on the     15th March 2022. Fixed in OpenSSL 3.0.2 (Affected 3.0.0,3.0.1). Fixed in OpenSSL 1.1.1n (Affected     1.1.1-1.1.1m). Fixed in OpenSSL 1.0.2zd (Affected 1.0.2-1.0.2zc). (CVE-2022-0778)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: C API). Supported versions that are     affected are 5.7.36 and prior and 8.0.27 and prior. Difficult to exploit vulnerability allows high     privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful     attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable     crash (complete DOS) of MySQL Server. (CVE-2022-21595)

  - MariaDB CONNECT Storage Engine Stack-based Buffer Overflow Privilege Escalation Vulnerability. This     vulnerability allows local attackers to escalate privileges on affected installations of MariaDB.
    Authentication is required to exploit this vulnerability. The specific flaw exists within the processing     of SQL queries. The issue results from the lack of proper validation of the length of user-supplied data     prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to     escalate privileges and execute arbitrary code in the context of the service account. Was ZDI-CAN-16191.
    (CVE-2022-24048)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:6443 advisory.

    MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL.

    The following packages have been upgraded to a later upstream version: mariadb (10.3.35), galera     (25.3.35).

    Security Fix(es):

    * mariadb: MariaDB through 10.5.9 allows attackers to trigger a convert_const_to_int use-after-free when     the BIGINT data type is used (CVE-2021-46669)

    * mysql: Server: FTS unspecified vulnerability (CPU Apr 2022) (CVE-2022-21427)

    * mariadb: lack of proper validation of the length of user-supplied data prior to copying it to a fixed-     length stack-based buffer (CVE-2022-24048)

    * mariadb: lack of validating the existence of an object prior to performing operations on the object     (CVE-2022-24050)

    * mariadb: lack of proper validation of a user-supplied string before using it as a format specifier     (CVE-2022-24051)

    * mariadb: CONNECT storage engine heap-based buffer overflow (CVE-2022-24052)

    * mariadb: assertion failure in Item_args::walk_arg (CVE-2022-27376)

    * mariadb: use-after-poison when complex conversion is involved in blob (CVE-2022-27377)

    * mariadb: server crash in create_tmp_table::finalize (CVE-2022-27378)

    * mariadb: server crash in component arg_comparator::compare_real_fixed (CVE-2022-27379)

    * mariadb: server crash at my_decimal::operator= (CVE-2022-27380)

    * mariadb: server crash at Field::set_default via specially crafted SQL statements (CVE-2022-27381)

    * mariadb: use-after-poison in my_strcasecmp_8bit() of ctype-simple.c (CVE-2022-27383)

    * mariadb: crash via component Item_subselect::init_expr_cache_tracker (CVE-2022-27384)

    * mariadb: server crashes in query_arena::set_query_arena upon SELECT from view (CVE-2022-27386)

    * mariadb: assertion failures in decimal_bin_size (CVE-2022-27387)

    * mariadb: assertion failure in compare_order_elements (CVE-2022-27445)

    * mariadb: use-after-poison in Binary_string::free_buffer (CVE-2022-27447)

    * mariadb: crash in multi-update and implicit grouping (CVE-2022-27448)

    * mariadb: assertion failure in sql/item_func.cc (CVE-2022-27449)

    * mariadb: assertion failure in sql/item_cmpfunc.cc (CVE-2022-27452)

    * mariadb: assertion failure in VDec::VDec at /sql/sql_type.cc (CVE-2022-27456)

    * mariadb: use-after-poison in Binary_string::free_buffer (CVE-2022-27458)

    * mariadb: improper locking due to the unreleased lock in extra/mariabackup/ds_compress.cc     (CVE-2022-31622)

    * mariadb: improper locking due to the unreleased lock in extra/mariabackup/ds_compress.cc     (CVE-2022-31623)

    * mariadb: server crash at Item_subselect::init_expr_cache_tracker (CVE-2022-32083)

    * mariadb: server crash in Item_func_in::cleanup/Item::cleanup_processor (CVE-2022-32085)

    * mariadb: server crash in Item_args::walk_args (CVE-2022-32087)

    * mariadb: segmentation fault in Exec_time_tracker::get_loops/Filesort_tracker::report_use/filesort     (CVE-2022-32088)

    * mariadb: Crash executing query with VIEW, aggregate and subquery (CVE-2021-46659)

    * mariadb: MariaDB allows an application crash in find_field_in_tables and find_order_in_list via an     unused common table expression (CTE) (CVE-2021-46661)

    * mariadb: MariaDB through 10.5.13 allows a ha_maria::extra application crash via certain SELECT     statements (CVE-2021-46663)

    * mariadb: MariaDB through 10.5.9 allows an application crash in sub_select_postjoin_aggr for a NULL value     of aggr (CVE-2021-46664)

    * mariadb: MariaDB through 10.5.9 allows a sql_parse.cc application crash because of incorrect used_tables     expectations (CVE-2021-46665)

    * mariadb: MariaDB through 10.5.9 allows an application crash via certain long SELECT DISTINCT statements     (CVE-2021-46668)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * [Tracker] Rebase to Galera 25.3.35 for MariaDB-10.3 (BZ#2107075)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:0631-1 advisory.

    - CVE-2022-38791: Fixed deadlock in compress_write in extra/mariabackup/ds_compress.cc (bsc#1202863).

    Version update from 10.4.26 to 10.4.28 (fixes CVE-2022-38791 and CVE-2022-38791).

    - Update to 10.4.28:
      * https://mariadb.com/kb/en/library/mariadb-10428-release-notes
      * https://mariadb.com/kb/en/library/mariadb-10428-changelog
      * https://mariadb.com/kb/en/library/mariadb-10427-release-notes
      * https://mariadb.com/kb/en/library/mariadb-10427-changelog

    - Update list of skipped tests
    - Update mariadb.keyring

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of MySQL Server installed on the remote host are affected by multiple vulnerabilities as referenced in the January and October 2022 CPU advisories.

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are     affected are 8.0.27 and prior. Easily exploitable vulnerability allows high privileged attacker with network access     via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in takeover     of MySQL Server. (CVE-2022-21600)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Compiling (cURL)). Supported versions     that are affected are 5.7.36 and prior and 8.0.27 and prior. Easily exploitable vulnerability allows     unauthenticated attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks     of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Server     accessible data. (CVE-2021-22946)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported     versions that are affected are 8.0.27 and prior. Easily exploitable vulnerability allows low privileged     attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this     vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete     DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server     accessible data. (CVE-2022-21351)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:7119 advisory.

    MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon (mysqld)     and many client programs and libraries.

    The following packages have been upgraded to a later upstream version: mysql (8.0.30).

    Security Fix(es):

    * mysql: Server: DML multiple unspecified vulnerabilities (CVE-2021-2478, CVE-2021-2479, CVE-2021-35591,     CVE-2021-35607, CVE-2022-21301, CVE-2022-21413)

    * mysql: Server: Optimizer multiple unspecified vulnerabilities (CVE-2021-2481, CVE-2021-35575,     CVE-2021-35577, CVE-2021-35610, CVE-2021-35612, CVE-2021-35626, CVE-2021-35627, CVE-2021-35628,     CVE-2021-35634, CVE-2021-35635, CVE-2021-35636, CVE-2021-35638, CVE-2021-35641, CVE-2021-35642,     CVE-2021-35643, CVE-2021-35644, CVE-2021-35645, CVE-2021-35646, CVE-2021-35647, CVE-2022-21253,     CVE-2022-21254, CVE-2022-21264, CVE-2022-21278, CVE-2022-21297, CVE-2022-21339, CVE-2022-21342,     CVE-2022-21351, CVE-2022-21370, CVE-2022-21378, CVE-2022-21412, CVE-2022-21414, CVE-2022-21435,     CVE-2022-21436, CVE-2022-21437, CVE-2022-21438, CVE-2022-21440, CVE-2022-21452, CVE-2022-21459,     CVE-2022-21462, CVE-2022-21478, CVE-2022-21479, CVE-2022-21509, CVE-2022-21525, CVE-2022-21526,     CVE-2022-21527, CVE-2022-21528, CVE-2022-21529, CVE-2022-21530, CVE-2022-21531, CVE-2022-21553,     CVE-2022-21569, CVE-2022-21265)

    * mysql: Server: Replication multiple unspecified vulnerabilities (CVE-2021-35546, CVE-2022-21344,     CVE-2022-21415)

    * mysql: Server: Error Handling unspecified vulnerability (CVE-2021-35596)

    * mysql: C API unspecified vulnerability (CVE-2021-35597)

    * mysql: Server: Options multiple unspecified vulnerabilities (CVE-2021-35602, CVE-2021-35630,     CVE-2022-21515)

    * mysql: InnoDB multiple unspecified vulnerabilities (CVE-2021-35604, CVE-2022-21302, CVE-2022-21348,     CVE-2022-21352, CVE-2022-21417, CVE-2022-21418, CVE-2022-21451, CVE-2022-21517, CVE-2022-21537,     CVE-2022-21539, CVE-2022-21423)

    * mysql: Server: Group Replication Plugin multiple unspecified vulnerabilities (CVE-2021-35608,     CVE-2022-21256, CVE-2022-21379, CVE-2022-21454)

    * mysql: Server: Security: Encryption multiple unspecified vulnerabilities (CVE-2021-35622,     CVE-2022-21358, CVE-2022-21372, CVE-2022-21538)

    * mysql: Server: Security: Privileges multiple unspecified vulnerabilities (CVE-2021-35624,     CVE-2022-21245, CVE-2021-35625)

    * mysql: Server: GIS unspecified vulnerability (CVE-2021-35631)

    * mysql: Server: Data Dictionary unspecified vulnerability (CVE-2021-35632)

    * mysql: Server: PS unspecified vulnerability (CVE-2021-35637)

    * mysql: Server: Stored Procedure multiple unspecified vulnerabilities (CVE-2021-35639, CVE-2022-21303,     CVE-2022-21522, CVE-2022-21534)

    * mysql: Server: FTS multiple unspecified vulnerabilities (CVE-2021-35648, CVE-2022-21427)

    * mysql: Server: Federated multiple unspecified vulnerabilities (CVE-2022-21270, CVE-2022-21547)

    * mysql: Server: Parser unspecified vulnerability (CVE-2022-21304)

    * mysql: Server: Information Schema multiple unspecified vulnerabilities (CVE-2022-21362, CVE-2022-21374)

    * mysql: Server: Compiling unspecified vulnerability (CVE-2022-21367)

    * mysql: Server: Components Services unspecified vulnerability (CVE-2022-21368)

    * mysql: Server: DDL multiple unspecified vulnerabilities (CVE-2022-21425, CVE-2022-21444, CVE-2021-35640,     CVE-2022-21249)

    * mysql: Server: PAM Auth Plugin unspecified vulnerability (CVE-2022-21457)

    * mysql: Server: Logging multiple unspecified vulnerabilities (CVE-2022-21460, CVE-2021-35633)

    * mysql: Server: Security: Roles unspecified vulnerability (CVE-2021-35623)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Rebuild mecab due to change in the suffix (from .el8 to .el8.0.0) [rhel-8] (BZ#2110940)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2022:7119 advisory.

    * mysql: Server: DML multiple unspecified vulnerabilities (CVE-2021-2478, CVE-2021-2479, CVE-2021-35591,     CVE-2021-35607, CVE-2022-21301, CVE-2022-21413)

    * mysql: Server: Optimizer multiple unspecified vulnerabilities (CVE-2021-2481, CVE-2021-35575,     CVE-2021-35577, CVE-2021-35610, CVE-2021-35612, CVE-2021-35626, CVE-2021-35627, CVE-2021-35628,     CVE-2021-35634, CVE-2021-35635, CVE-2021-35636, CVE-2021-35638, CVE-2021-35641, CVE-2021-35642,     CVE-2021-35643, CVE-2021-35644, CVE-2021-35645, CVE-2021-35646, CVE-2021-35647, CVE-2022-21253,     CVE-2022-21254, CVE-2022-21264, CVE-2022-21278, CVE-2022-21297, CVE-2022-21339, CVE-2022-21342,     CVE-2022-21351, CVE-2022-21370, CVE-2022-21378, CVE-2022-21412, CVE-2022-21414, CVE-2022-21435,     CVE-2022-21436, CVE-2022-21437, CVE-2022-21438, CVE-2022-21440, CVE-2022-21452, CVE-2022-21459,     CVE-2022-21462, CVE-2022-21478, CVE-2022-21479, CVE-2022-21509, CVE-2022-21525, CVE-2022-21526,     CVE-2022-21527, CVE-2022-21528, CVE-2022-21529, CVE-2022-21530, CVE-2022-21531, CVE-2022-21553,     CVE-2022-21569, CVE-2022-21265)

    * mysql: Server: Replication multiple unspecified vulnerabilities (CVE-2021-35546, CVE-2022-21344,     CVE-2022-21415)

    * mysql: Server: Error Handling unspecified vulnerability (CVE-2021-35596)

    * mysql: C API unspecified vulnerability (CVE-2021-35597)

    * mysql: Server: Options multiple unspecified vulnerabilities (CVE-2021-35602, CVE-2021-35630,     CVE-2022-21515)

    * mysql: InnoDB multiple unspecified vulnerabilities (CVE-2021-35604, CVE-2022-21302, CVE-2022-21348,     CVE-2022-21352, CVE-2022-21417, CVE-2022-21418, CVE-2022-21451, CVE-2022-21517, CVE-2022-21537,     CVE-2022-21539, CVE-2022-21423)

    * mysql: Server: Group Replication Plugin multiple unspecified vulnerabilities (CVE-2021-35608,     CVE-2022-21256, CVE-2022-21379, CVE-2022-21454)

    * mysql: Server: Security: Encryption multiple unspecified vulnerabilities (CVE-2021-35622,     CVE-2022-21358, CVE-2022-21372, CVE-2022-21538)

    * mysql: Server: Security: Privileges multiple unspecified vulnerabilities (CVE-2021-35624,     CVE-2022-21245, CVE-2021-35625)

    * mysql: Server: GIS unspecified vulnerability (CVE-2021-35631)

    * mysql: Server: Data Dictionary unspecified vulnerability (CVE-2021-35632)

    * mysql: Server: PS unspecified vulnerability (CVE-2021-35637)

    * mysql: Server: Stored Procedure multiple unspecified vulnerabilities (CVE-2021-35639, CVE-2022-21303,     CVE-2022-21522, CVE-2022-21534)

    * mysql: Server: FTS multiple unspecified vulnerabilities (CVE-2021-35648, CVE-2022-21427)

    * mysql: Server: Federated multiple unspecified vulnerabilities (CVE-2022-21270, CVE-2022-21547)

    * mysql: Server: Parser unspecified vulnerability (CVE-2022-21304)

    * mysql: Server: Information Schema multiple unspecified vulnerabilities (CVE-2022-21362, CVE-2022-21374)

    * mysql: Server: Compiling unspecified vulnerability (CVE-2022-21367)

    * mysql: Server: Components Services unspecified vulnerability (CVE-2022-21368)

    * mysql: Server: DDL multiple unspecified vulnerabilities (CVE-2022-21425, CVE-2022-21444, CVE-2021-35640,     CVE-2022-21249)

    * mysql: Server: PAM Auth Plugin unspecified vulnerability (CVE-2022-21457)

    * mysql: Server: Logging multiple unspecified vulnerabilities (CVE-2022-21460, CVE-2021-35633)

    * mysql: Server: Security: Roles unspecified vulnerability (CVE-2021-35623)

Tenable has extracted the preceding description block directly from the Rocky Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of MariaDB installed on the remote host is prior to 10.4.23. It is, therefore, affected by multiple vulnerabilities as referenced in the 10.4.23 advisory.

  - MariaDB CONNECT Storage Engine Heap-based Buffer Overflow Privilege Escalation Vulnerability. This     vulnerability allows local attackers to escalate privileges on affected installations of MariaDB.
    Authentication is required to exploit this vulnerability. The specific flaw exists within the processing     of SQL queries. The issue results from the lack of proper validation of the length of user-supplied data     prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to     escalate privileges and execute arbitrary code in the context of the service account. Was ZDI-CAN-16190.
    (CVE-2022-24052)

  - MariaDB before 10.7.2 allows an application crash because it does not recognize that     SELECT_LEX::nest_level is local to each VIEW. (CVE-2021-46659)

  - The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop     forever for non-prime moduli. Internally this function is used when parsing certificates that contain     elliptic curve public keys in compressed form or explicit elliptic curve parameters with a base point     encoded in compressed form. It is possible to trigger the infinite loop by crafting a certificate that has     invalid explicit curve parameters. Since certificate parsing happens prior to verification of the     certificate signature, any process that parses an externally supplied certificate may thus be subject to a     denial of service attack. The infinite loop can also be reached when parsing crafted private keys as they     can contain explicit elliptic curve parameters. Thus vulnerable situations include: - TLS clients     consuming server certificates - TLS servers consuming client certificates - Hosting providers taking     certificates or private keys from customers - Certificate authorities parsing certification requests from     subscribers - Anything else which parses ASN.1 elliptic curve parameters Also any other applications that     use the BN_mod_sqrt() where the attacker can control the parameter values are vulnerable to this DoS     issue. In the OpenSSL 1.0.2 version the public key is not parsed during initial parsing of the certificate     which makes it slightly harder to trigger the infinite loop. However any operation which requires the     public key from the certificate will trigger the infinite loop. In particular the attacker can use a self-     signed certificate to trigger the loop during verification of the certificate signature. This issue     affects OpenSSL versions 1.0.2, 1.1.1 and 3.0. It was addressed in the releases of 1.1.1n and 3.0.2 on the     15th March 2022. Fixed in OpenSSL 3.0.2 (Affected 3.0.0,3.0.1). Fixed in OpenSSL 1.1.1n (Affected     1.1.1-1.1.1m). Fixed in OpenSSL 1.0.2zd (Affected 1.0.2-1.0.2zc). (CVE-2022-0778)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: C API). Supported versions that are     affected are 5.7.36 and prior and 8.0.27 and prior. Difficult to exploit vulnerability allows high     privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful     attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable     crash (complete DOS) of MySQL Server. (CVE-2022-21595)

  - MariaDB CONNECT Storage Engine Stack-based Buffer Overflow Privilege Escalation Vulnerability. This     vulnerability allows local attackers to escalate privileges on affected installations of MariaDB.
    Authentication is required to exploit this vulnerability. The specific flaw exists within the processing     of SQL queries. The issue results from the lack of proper validation of the length of user-supplied data     prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to     escalate privileges and execute arbitrary code in the context of the service account. Was ZDI-CAN-16191.
    (CVE-2022-24048)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1773654558 advisory.

  - In SQLite through 3.31.1, the ALTER TABLE implementation has a use-after-free, as demonstrated by an ORDER     BY clause that belongs to a compound SELECT statement. (CVE-2020-11656)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions     that are affected are 5.7.30 and prior and 8.0.20 and prior. Easily exploitable vulnerability allows high     privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful     attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable     crash (complete DOS) of MySQL Server. (CVE-2020-14540)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema).
    Supported versions that are affected are 5.6.48 and prior, 5.7.30 and prior and 8.0.20 and prior. Easily     exploitable vulnerability allows low privileged attacker with network access via multiple protocols to     compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized read access     to a subset of MySQL Server accessible data. (CVE-2020-14559)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are     affected are 8.0.20 and prior. Easily exploitable vulnerability allows high privileged attacker with     network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability     can result in unauthorized read access to a subset of MySQL Server accessible data. (CVE-2020-14634)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Roles). Supported     versions that are affected are 8.0.20 and prior. Easily exploitable vulnerability allows high privileged     attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this     vulnerability can result in unauthorized access to critical data or complete access to all MySQL Server     accessible data. (CVE-2020-14641)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2022_5948 advisory.

    * mariadb: MariaDB through 10.5.9 allows attackers to trigger a convert_const_to_int use-after-free when     the BIGINT data type is used (CVE-2021-46669)

    * mariadb: lack of proper validation of the length of user-supplied data prior to copying it to a fixed-     length stack-based buffer (CVE-2022-24048)

    * mariadb: lack of validating the existence of an object prior to performing operations on the object     (CVE-2022-24050)

    * mariadb: lack of proper validation of a user-supplied string before using it as a format specifier     (CVE-2022-24051)

    * mariadb: CONNECT Storage Engine Heap-based Buffer Overflow Privilege Escalation Vulnerability     (CVE-2022-24052)

    * mariadb: assertion failure in Item_args::walk_arg (CVE-2022-27376)

    * mariadb: use-after-poison when complex conversion is involved in blob (CVE-2022-27377)

    * mariadb: server crash in create_tmp_table::finalize (CVE-2022-27378)

    * mariadb: server crash in component arg_comparator::compare_real_fixed (CVE-2022-27379)

    * mariadb: server crash at my_decimal::operator= (CVE-2022-27380)

    * mariadb: server crash at Field::set_default via specially crafted SQL statements (CVE-2022-27381)

    * mariadb: assertion failure via component Item_field::used_tables/update_depend_map_for_order     (CVE-2022-27382)

    * mariadb: use-after-poison in my_strcasecmp_8bit() of ctype-simple.c (CVE-2022-27383)

    * mariadb: crash via component Item_subselect::init_expr_cache_tracker (CVE-2022-27384)

    * mariadb: server crashes in query_arena::set_query_arena upon SELECT from view (CVE-2022-27386)

    * mariadb: assertion failures in decimal_bin_size (CVE-2022-27387)

    * mariadb: crash when using HAVING with NOT EXIST predicate in an equality (CVE-2022-27444)

    * mariadb: assertion failure in compare_order_elements (CVE-2022-27445)

    * mariadb: crash when using HAVING with IS NULL predicate in an equality (CVE-2022-27446)

    * mariadb: use-after-poison in Binary_string::free_buffer (CVE-2022-27447)

    * mariadb: crash in multi-update and implicit grouping (CVE-2022-27448)

    * mariadb: assertion failure in sql/item_func.cc (CVE-2022-27449)

    * mariadb: crash via window function in expression in ORDER BY (CVE-2022-27451)

    * mariadb: assertion failure in sql/item_cmpfunc.cc (CVE-2022-27452)

    * mariadb: use-after-free when WHERE has subquery with an outer reference in HAVING (CVE-2022-27455)

    * mariadb: assertion failure in VDec::VDec at /sql/sql_type.cc (CVE-2022-27456)

    * mariadb: incorrect key in dup value error after long unique (CVE-2022-27457)

    * mariadb: use-after-poison in Binary_string::free_buffer (CVE-2022-27458)

    * mariadb: improper locking due to the unreleased lock in extra/mariabackup/ds_compress.cc     (CVE-2022-31622)

    * mariadb: improper locking due to the unreleased lock in extra/mariabackup/ds_compress.cc     (CVE-2022-31623)

    * mariadb: Crash executing query with VIEW, aggregate and subquery (CVE-2021-46659)

    * mariadb: MariaDB allows an application crash in find_field_in_tables and find_order_in_list via an     unused common table expression (CTE) (CVE-2021-46661)

    * mariadb: MariaDB through 10.5.13 allows a ha_maria::extra application crash via certain SELECT     statements (CVE-2021-46663)

    * mariadb: MariaDB through 10.5.9 allows an application crash in sub_select_postjoin_aggr for a NULL value     of aggr (CVE-2021-46664)

    * mariadb: MariaDB through 10.5.9 allows a sql_parse.cc application crash because of incorrect used_tables     expectations (CVE-2021-46665)

    * mariadb: MariaDB through 10.5.9 allows an application crash via certain long SELECT DISTINCT statements     (CVE-2021-46668)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of MariaDB installed on the remote host is prior to 10.2.42. It is, therefore, affected by multiple vulnerabilities as referenced in the 10.2.42 advisory.

  - MariaDB CONNECT Storage Engine Heap-based Buffer Overflow Privilege Escalation Vulnerability. This     vulnerability allows local attackers to escalate privileges on affected installations of MariaDB.
    Authentication is required to exploit this vulnerability. The specific flaw exists within the processing     of SQL queries. The issue results from the lack of proper validation of the length of user-supplied data     prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to     escalate privileges and execute arbitrary code in the context of the service account. Was ZDI-CAN-16190.
    (CVE-2022-24052)

  - MariaDB before 10.7.2 allows an application crash because it does not recognize that     SELECT_LEX::nest_level is local to each VIEW. (CVE-2021-46659)

  - The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop     forever for non-prime moduli. Internally this function is used when parsing certificates that contain     elliptic curve public keys in compressed form or explicit elliptic curve parameters with a base point     encoded in compressed form. It is possible to trigger the infinite loop by crafting a certificate that has     invalid explicit curve parameters. Since certificate parsing happens prior to verification of the     certificate signature, any process that parses an externally supplied certificate may thus be subject to a     denial of service attack. The infinite loop can also be reached when parsing crafted private keys as they     can contain explicit elliptic curve parameters. Thus vulnerable situations include: - TLS clients     consuming server certificates - TLS servers consuming client certificates - Hosting providers taking     certificates or private keys from customers - Certificate authorities parsing certification requests from     subscribers - Anything else which parses ASN.1 elliptic curve parameters Also any other applications that     use the BN_mod_sqrt() where the attacker can control the parameter values are vulnerable to this DoS     issue. In the OpenSSL 1.0.2 version the public key is not parsed during initial parsing of the certificate     which makes it slightly harder to trigger the infinite loop. However any operation which requires the     public key from the certificate will trigger the infinite loop. In particular the attacker can use a self-     signed certificate to trigger the loop during verification of the certificate signature. This issue     affects OpenSSL versions 1.0.2, 1.1.1 and 3.0. It was addressed in the releases of 1.1.1n and 3.0.2 on the     15th March 2022. Fixed in OpenSSL 3.0.2 (Affected 3.0.0,3.0.1). Fixed in OpenSSL 1.1.1n (Affected     1.1.1-1.1.1m). Fixed in OpenSSL 1.0.2zd (Affected 1.0.2-1.0.2zc). (CVE-2022-0778)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: C API). Supported versions that are     affected are 5.7.36 and prior and 8.0.27 and prior. Difficult to exploit vulnerability allows high     privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful     attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable     crash (complete DOS) of MySQL Server. (CVE-2022-21595)

  - MariaDB CONNECT Storage Engine Stack-based Buffer Overflow Privilege Escalation Vulnerability. This     vulnerability allows local attackers to escalate privileges on affected installations of MariaDB.
    Authentication is required to exploit this vulnerability. The specific flaw exists within the processing     of SQL queries. The issue results from the lack of proper validation of the length of user-supplied data     prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to     escalate privileges and execute arbitrary code in the context of the service account. Was ZDI-CAN-16191.
    (CVE-2022-24048)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:5826 advisory.

    MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL.

    The following packages have been upgraded to a later upstream version: galera (26.4.11), mariadb     (10.5.16).

    Security Fix(es):

    * mariadb: MariaDB through 10.5.9 allows attackers to trigger a convert_const_to_int use-after-free when     the BIGINT data type is used (CVE-2021-46669)

    * mariadb: lack of proper validation of the length of user-supplied data prior to copying it to a fixed-     length stack-based buffer (CVE-2022-24048)

    * mariadb: lack of validating the existence of an object prior to performing operations on the object     (CVE-2022-24050)

    * mariadb: lack of proper validation of a user-supplied string before using it as a format specifier     (CVE-2022-24051)

    * mariadb: CONNECT Storage Engine Heap-based Buffer Overflow Privilege Escalation Vulnerability     (CVE-2022-24052)

    * mariadb: assertion failure in Item_args::walk_arg (CVE-2022-27376)

    * mariadb: use-after-poison when complex conversion is involved in blob (CVE-2022-27377)

    * mariadb: crash in create_tmp_table::finalize (CVE-2022-27378)

    * mariadb: crash in component arg_comparator::compare_real_fixed (CVE-2022-27379)

    * mariadb: crash at my_decimal::operator= (CVE-2022-27380)

    * mariadb: crash at Field::set_default via specially crafted SQL statements (CVE-2022-27381)

    * mariadb: assertion failure via component Item_field::used_tables/update_depend_map_for_order     (CVE-2022-27382)

    * mariadb: use-after-poison in my_strcasecmp_8bit() of ctype-simple.c (CVE-2022-27383)

    * mariadb: via component Item_subselect::init_expr_cache_tracker (CVE-2022-27384)

    * mariadb: crash in query_arena::set_query_arena upon SELECT from view (CVE-2022-27386)

    * mariadb: assertion failures in decimal_bin_size (CVE-2022-27387)

    * mariadb: crash when using HAVING with NOT EXIST predicate in an equality (CVE-2022-27444)

    * mariadb: assertion failure in compare_order_elements (CVE-2022-27445)

    * mariadb: crash when using HAVING with IS NULL predicate in an equality (CVE-2022-27446)

    * mariadb: use-after-poison in Binary_string::free_buffer (CVE-2022-27447)

    * mariadb: crash in multi-update and implicit grouping (CVE-2022-27448)

    * mariadb: assertion failure in sql/item_func.cc (CVE-2022-27449)

    * mariadb: crash via window function in expression in ORDER BY (CVE-2022-27451)

    * mariadb: assertion failure in sql/item_cmpfunc.cc (CVE-2022-27452)

    * mariadb: use-after-free when WHERE has subquery with an outer reference in HAVING (CVE-2022-27455)

    * mariadb: assertion failure in VDec::VDec at /sql/sql_type.cc (CVE-2022-27456)

    * mariadb: incorrect key in dup value error after long unique (CVE-2022-27457)

    * mariadb: use-after-poison in Binary_string::free_buffer (CVE-2022-27458)

    * mariadb: improper locking due to the unreleased lock in extra/mariabackup/ds_compress.cc     (CVE-2022-31622)

    * mariadb: improper locking due to the unreleased lock in extra/mariabackup/ds_compress.cc     (CVE-2022-31623)

    * mariadb: Crash executing query with VIEW, aggregate and subquery (CVE-2021-46659)

    * mariadb: MariaDB allows an application crash in find_field_in_tables and find_order_in_list via an     unused common table expression (CTE) (CVE-2021-46661)

    * mariadb: MariaDB through 10.5.13 allows a ha_maria::extra application crash via certain SELECT     statements (CVE-2021-46663)

    * mariadb: crash in sub_select_postjoin_aggr for a NULL value of aggr (CVE-2021-46664)

    * mariadb: crash because of incorrect used_tables expectations (CVE-2021-46665)

    * mariadb: crash via certain long SELECT DISTINCT statements (CVE-2021-46668)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Don't use less parallelism if not necessary (BZ#2096934)

    * Links in galera package description are bad (BZ#2096935)

    * [Tracker] Rebase to Galera 26.4.11 (BZ#2096936)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:6518 advisory.

    MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon, mysqld,     and many client programs.

    The following packages have been upgraded to a later upstream version: rh-mysql80-mysql (8.0.30).
    (BZ#2076939)

    Security Fix(es):

    * mysql: Server: DML multiple unspecified vulnerabilities (CVE-2021-2478, CVE-2021-2479, CVE-2021-35591,     CVE-2021-35607, CVE-2022-21301, CVE-2022-21413)

    * mysql: Server: Optimizer multiple unspecified vulnerabilities (CVE-2021-2481, CVE-2021-35575,     CVE-2021-35577, CVE-2021-35610, CVE-2021-35612, CVE-2021-35626, CVE-2021-35627, CVE-2021-35628,     CVE-2021-35634, CVE-2021-35635, CVE-2021-35636, CVE-2021-35638, CVE-2021-35641, CVE-2021-35642,     CVE-2021-35643, CVE-2021-35644, CVE-2021-35645, CVE-2021-35646, CVE-2021-35647, CVE-2022-21253,     CVE-2022-21254, CVE-2022-21264, CVE-2022-21278, CVE-2022-21297, CVE-2022-21339, CVE-2022-21342,     CVE-2022-21351, CVE-2022-21370, CVE-2022-21378, CVE-2022-21412, CVE-2022-21414, CVE-2022-21435,     CVE-2022-21436, CVE-2022-21437, CVE-2022-21438, CVE-2022-21440, CVE-2022-21452, CVE-2022-21459,     CVE-2022-21462, CVE-2022-21478, CVE-2022-21479, CVE-2022-21509, CVE-2022-21525, CVE-2022-21526,     CVE-2022-21527, CVE-2022-21528, CVE-2022-21529, CVE-2022-21530, CVE-2022-21531, CVE-2022-21553,     CVE-2022-21556, CVE-2022-21569, CVE-2022-21265)

    * mysql: Server: Replication multiple unspecified vulnerabilities (CVE-2021-35546, CVE-2022-21344,     CVE-2022-21415)

    * mysql: Server: Error Handling unspecified vulnerability (CVE-2021-35596)

    * mysql: C API unspecified vulnerability (CVE-2021-35597)

    * mysql: Server: Options multiple unspecified vulnerabilities (CVE-2021-35602, CVE-2021-35630,     CVE-2022-21515)

    * mysql: InnoDB multiple unspecified vulnerabilities (CVE-2021-35604, CVE-2022-21302, CVE-2022-21348,     CVE-2022-21352, CVE-2022-21417, CVE-2022-21418, CVE-2022-21451, CVE-2022-21517, CVE-2022-21537,     CVE-2022-21539, CVE-2022-21423)

    * mysql: Server: Group Replication Plugin multiple unspecified vulnerabilities (CVE-2021-35608,     CVE-2022-21256, CVE-2022-21379, CVE-2022-21454)

    * mysql: Server: Security: Encryption multiple unspecified vulnerabilities (CVE-2021-35622,     CVE-2022-21358, CVE-2022-21372, CVE-2022-21538)

    * mysql: Server: Security: Privileges multiple unspecified vulnerabilities (CVE-2021-35624,     CVE-2022-21245, CVE-2021-35625)

    * mysql: Server: GIS unspecified vulnerability (CVE-2021-35631)

    * mysql: Server: Data Dictionary unspecified vulnerability (CVE-2021-35632)

    * mysql: Server: PS unspecified vulnerability (CVE-2021-35637)

    * mysql: Server: Stored Procedure multiple unspecified vulnerabilities (CVE-2021-35639, CVE-2022-21303,     CVE-2022-21522, CVE-2022-21534)

    * mysql: Server: FTS multiple unspecified vulnerabilities (CVE-2021-35648, CVE-2022-21427)

    * mysql: Server: Federated multiple unspecified vulnerabilities (CVE-2022-21270, CVE-2022-21547)

    * mysql: Server: Parser unspecified vulnerability (CVE-2022-21304)

    * mysql: Server: Information Schema multiple unspecified vulnerabilities (CVE-2022-21362, CVE-2022-21374)

    * mysql: Server: Compiling unspecified vulnerability (CVE-2022-21367)

    * mysql: Server: Components Services unspecified vulnerability (CVE-2022-21368)

    * mysql: Server: DDL multiple unspecified vulnerabilities (CVE-2022-21425, CVE-2022-21444, CVE-2021-35640,     CVE-2022-21249)

    * mysql: Server: PAM Auth Plugin multiple unspecified vulnerabilities (CVE-2022-21455, CVE-2022-21457)

    * mysql: Server: Logging multiple unspecified vulnerabilities (CVE-2022-21460, CVE-2021-35633)

    * mysql: Server: Security: Roles unspecified vulnerability (CVE-2021-35623)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
157462	MariaDB 10.5.0 < 10.5.14 Multiple Vulnerabilities	Nessus	Databases	2022/2/9	2026/1/29	high
164973	RHEL 8 : mariadb:10.3 (RHSA-2022:6443)	Nessus	Red Hat Local Security Checks	2022/9/13	2025/9/24	high
172174	SUSE SLES15: libmariadbd-devel / libmariadbd19 / mariadb / mariadb-client / etc (SUSE-SU-2023:0631-1)	Nessus	SuSE Local Security Checks	2023/3/7	2026/6/26	medium
156908	Oracle MySQL Server (Jan 2022 CPU)	Nessus	Databases	2022/1/20	2025/4/18	high
166543	RHEL 8 : mysql:8.0 (RHSA-2022:7119)	Nessus	Red Hat Local Security Checks	2022/10/26	2025/4/8	high
185005	Rocky Linux 8 : mysql:8.0 (RLSA-2022:7119)	Nessus	Rocky Linux Local Security Checks	2023/11/7	2024/7/10	high
157464	MariaDB 10.4.0 < 10.4.23 Multiple Vulnerabilities	Nessus	Databases	2022/2/9	2026/1/29	high
352245	AlmaLinux 9.2 [TuxCare] Security Update: mysql / mysql-common / mysql-devel / mysql-errmsg / mysql-libs / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1773654558)	Nessus	Alma Linux Local Security Checks	2026/9/30	2026/10/1	high
357625	Rocky Linux 9 [CIQ] Security Update: galera / galera-debuginfo / galera-debugsource / mariadb / etc Multiple Vulnerabilities (crlsa-2022_5948)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	high
157461	MariaDB 10.2.0 < 10.2.42 Multiple Vulnerabilities	Nessus	Databases	2022/2/9	2026/1/29	high
163732	RHEL 8 : mariadb:10.5 (RHSA-2022:5826)	Nessus	Red Hat Local Security Checks	2022/8/2	2025/9/24	high
165092	RHEL 7 : rh-mysql80-mysql (RHSA-2022:6518)	Nessus	Red Hat Local Security Checks	2022/9/14	2024/11/7	high

检测

插件搜索

high

high

medium

high

high

high

high

high

high

high

high

high