VMware Tanzu Isolation Segment update for MySQL



Published: 2023-05-26
Risk Medium
Patch available YES
Number of vulnerabilities 20
CVE-ID CVE-2023-21876
CVE-2023-21887
CVE-2023-21883
CVE-2023-21882
CVE-2023-21881
CVE-2023-21880
CVE-2023-21879
CVE-2023-21878
CVE-2023-21877
CVE-2023-21875
CVE-2022-32221
CVE-2023-21873
CVE-2023-21871
CVE-2023-21870
CVE-2023-21869
CVE-2023-21868
CVE-2023-21867
CVE-2023-21863
CVE-2023-21840
CVE-2023-21836
CWE-ID CWE-20
CWE-440
Exploitation vector Network
Public exploit N/A
Vulnerable software
Subscribe 		Isolation Segment
Server applications / Other server solutions

Vendor VMware, Inc

Security Bulletin

This security bulletin contains information about 20 vulnerabilities.

1) Improper input validation

EUVDB-ID: #VU71279

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2023-21876

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote privileged user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server: Optimizer component in MySQL Server. A remote privileged user can exploit this vulnerability to perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions All versions
CPE2.3 External links

http://tanzu.vmware.com/security/usn-5823-1


Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

2) Improper input validation

EUVDB-ID: #VU71271

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2023-21887

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote privileged user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server: GIS component in MySQL Server. A remote privileged user can exploit this vulnerability to perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions All versions
CPE2.3 External links

http://tanzu.vmware.com/security/usn-5823-1


Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

3) Improper input validation

EUVDB-ID: #VU71283

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2023-21883

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote privileged user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server: Optimizer component in MySQL Server. A remote privileged user can exploit this vulnerability to perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions All versions
CPE2.3 External links

http://tanzu.vmware.com/security/usn-5823-1


Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

4) Improper input validation

EUVDB-ID: #VU71285

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2023-21882

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote privileged user to manipulate data.

The vulnerability exists due to improper input validation within the Server: Optimizer component in MySQL Server. A remote privileged user can exploit this vulnerability to manipulate data.

Mitigation

Install update from vendor's website.

Vulnerable software versions All versions
CPE2.3 External links

http://tanzu.vmware.com/security/usn-5823-1


Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

5) Improper input validation

EUVDB-ID: #VU71282

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2023-21881

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote privileged user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server: Optimizer component in MySQL Server. A remote privileged user can exploit this vulnerability to perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions All versions
CPE2.3 External links

http://tanzu.vmware.com/security/usn-5823-1


Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

6) Improper input validation

EUVDB-ID: #VU71267

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2023-21880

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote privileged user to damange or delete data.

The vulnerability exists due to improper input validation within the InnoDB component in MySQL Server. A remote privileged user can exploit this vulnerability to damange or delete data.

Mitigation

Install update from vendor's website.

Vulnerable software versions All versions
CPE2.3 External links

http://tanzu.vmware.com/security/usn-5823-1


Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

7) Improper input validation

EUVDB-ID: #VU71281

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2023-21879

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote privileged user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server: Optimizer component in MySQL Server. A remote privileged user can exploit this vulnerability to perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions All versions
CPE2.3 External links

http://tanzu.vmware.com/security/usn-5823-1


Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

8) Improper input validation

EUVDB-ID: #VU71280

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2023-21878

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote privileged user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server: Optimizer component in MySQL Server. A remote privileged user can exploit this vulnerability to perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions All versions
CPE2.3 External links

http://tanzu.vmware.com/security/usn-5823-1


Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

9) Improper input validation

EUVDB-ID: #VU71266

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2023-21877

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote privileged user to damange or delete data.

The vulnerability exists due to improper input validation within the InnoDB component in MySQL Server. A remote privileged user can exploit this vulnerability to damange or delete data.

Mitigation

Install update from vendor's website.

Vulnerable software versions All versions
CPE2.3 External links

http://tanzu.vmware.com/security/usn-5823-1


Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

10) Improper input validation

EUVDB-ID: #VU71264

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2023-21875

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote privileged user to damange or delete data.

The vulnerability exists due to improper input validation within the Server: Security: Encryption component in MySQL Server. A remote privileged user can exploit this vulnerability to damange or delete data.

Mitigation

Install update from vendor's website.

Vulnerable software versions All versions
CPE2.3 External links

http://tanzu.vmware.com/security/usn-5823-1


Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

11) Expected behavior violation

EUVDB-ID: #VU68746

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2022-32221

CWE-ID: CWE-440 - Expected Behavior Violation

Exploit availability: No

Description

The vulnerability allows a remote attacker to force unexpected application behavior.

The vulnerability exists due to a logic error for a reused handle when processing subsequent HTTP PUT and POST requests. The libcurl can erroneously use the read callback (CURLOPT_READFUNCTION) to ask for data to send, even when the CURLOPT_POSTFIELDS option has been set, if the same handle previously was used to issue a PUT request, which used that callback. As a result, such behavior can influence application flow and force unpredictable outcome.

Mitigation

Install update from vendor's website.

Vulnerable software versions All versions
CPE2.3 External links

http://tanzu.vmware.com/security/usn-5823-1


Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

12) Improper input validation

EUVDB-ID: #VU71278

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2023-21873

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote privileged user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server: Optimizer component in MySQL Server. A remote privileged user can exploit this vulnerability to perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions All versions
CPE2.3 External links

http://tanzu.vmware.com/security/usn-5823-1


Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

13) Improper input validation

EUVDB-ID: #VU71269

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2023-21871

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote privileged user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the InnoDB component in MySQL Server. A remote privileged user can exploit this vulnerability to perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions All versions
CPE2.3 External links

http://tanzu.vmware.com/security/usn-5823-1


Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

14) Improper input validation

EUVDB-ID: #VU71277

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2023-21870

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote privileged user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server: Optimizer component in MySQL Server. A remote privileged user can exploit this vulnerability to perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions All versions
CPE2.3 External links

http://tanzu.vmware.com/security/usn-5823-1


Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

15) Improper input validation

EUVDB-ID: #VU71265

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2023-21869

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote privileged user to damange or delete data.

The vulnerability exists due to improper input validation within the InnoDB component in MySQL Server. A remote privileged user can exploit this vulnerability to damange or delete data.

Mitigation

Install update from vendor's website.

Vulnerable software versions All versions
CPE2.3 External links

http://tanzu.vmware.com/security/usn-5823-1


Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

16) Improper input validation

EUVDB-ID: #VU71262

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2023-21868

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote authenticated user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server: Optimizer component in MySQL Server. A remote authenticated user can exploit this vulnerability to perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions All versions
CPE2.3 External links

http://tanzu.vmware.com/security/usn-5823-1


Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

17) Improper input validation

EUVDB-ID: #VU71276

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2023-21867

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote privileged user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server: Optimizer component in MySQL Server. A remote privileged user can exploit this vulnerability to perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions All versions
CPE2.3 External links

http://tanzu.vmware.com/security/usn-5823-1


Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

18) Improper input validation

EUVDB-ID: #VU71272

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2023-21863

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote privileged user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server: Optimizer component in MySQL Server. A remote privileged user can exploit this vulnerability to perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions All versions
CPE2.3 External links

http://tanzu.vmware.com/security/usn-5823-1


Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

19) Improper input validation

EUVDB-ID: #VU71284

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2023-21840

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote privileged user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server: PS component in MySQL Server. A remote privileged user can exploit this vulnerability to perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions All versions
CPE2.3 External links

http://tanzu.vmware.com/security/usn-5823-1


Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

20) Improper input validation

EUVDB-ID: #VU71270

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2023-21836

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote privileged user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server: DML component in MySQL Server. A remote privileged user can exploit this vulnerability to perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions All versions
CPE2.3 External links

http://tanzu.vmware.com/security/usn-5823-1


Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?



###SIDEBAR###