Insecure automated optimizations in MariaDB - CVE-2023-52969

Vulnerability identifier: #VU120622

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-52969

CWE-ID: CWE-1038

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to perform a denial of service attack.

The vulnerability exists due to insecure automated optimization when handling derived tables within the SELECT clause. A remote privileged user can crash the server with a specially crafted query. 

MariaDB
SUSE Linux Enterprise Server 15 SP3
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing 15
Galera for Ericsson 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Enterprise Storage
Anolis OS
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Slackware Linux
SUSE Package Hub 15
Server Applications Module
openSUSE Leap
openEuler
Ubuntu
Fedora
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
Judy-devel
Judy
asio-devel
mariadb
mariadb-config
mariadb-test
mariadb-server-utils
mariadb-server-galera
mariadb-server
mariadb-rocksdb-engine
mariadb-pam
mariadb-oqgraph-engine
mariadb-gssapi-server
mariadb-errmsg
mariadb-embedded-devel
mariadb-embedded
mariadb-devel
mariadb-debugsource
mariadb-debuginfo
mariadb-backup
mariadb-common
mariadb (Red Hat package)
libmariadbd19
mariadb-client-debuginfo
mariadb-errormessages
mariadb-rpm-macros
mariadb-bench-debuginfo
mariadb-galera
libmariadbd-devel
mariadb-test-debuginfo
mariadb-client
mariadb-tools
libmariadbd19-debuginfo
mariadb-bench
mariadb-tools-debuginfo
mariadb-10.6 (Ubuntu package)
mariadb10.11
mariadb (Ubuntu package)
mariadb10.11 (Red Hat package)
galera
galera (Red Hat package)
IBM Cloud Object Storage Systems

Install updates from vendor's website.

MariaDB - addressed in versions 10.5.29, 10.6.22, 10.11.12, 11.4.6, 11.8.2
Judy-devel - update to 1.0.5-18
Judy - update to 1.0.5-18
asio-devel - update to 1.10.8-7
IBM Cloud Object Storage Systems - addressed in versions 3.20.0.43, 3.20.0.69
mariadb - update to 10.5.29
mariadb - update to 10.5.29-1
mariadb-config - update to 10.5.29-1
mariadb-test - update to 10.5.29-1
mariadb-server-utils - update to 10.5.29-1
mariadb-server-galera - update to 10.5.29-1
mariadb-server - update to 10.5.29-1
mariadb-rocksdb-engine - update to 10.5.29-1
mariadb-pam - update to 10.5.29-1
mariadb-oqgraph-engine - update to 10.5.29-1
mariadb-gssapi-server - update to 10.5.29-1
mariadb-errmsg - update to 10.5.29-1
mariadb-embedded-devel - update to 10.5.29-1
mariadb-embedded - update to 10.5.29-1
mariadb-devel - update to 10.5.29-1
mariadb-debugsource - update to 10.5.29-1
mariadb-debuginfo - update to 10.5.29-1
mariadb-backup - update to 10.5.29-1
mariadb-common - update to 10.5.29-1
mariadb (Red Hat package) - update to 10.5.29-2.el9_6
mariadb-server-utils - update to 10.5.29-2.0.1
mariadb-server-galera - update to 10.5.29-2.0.1
mariadb-server - update to 10.5.29-2.0.1
mariadb-pam - update to 10.5.29-2.0.1
mariadb-oqgraph-engine - update to 10.5.29-2.0.1
mariadb-gssapi-server - update to 10.5.29-2.0.1
mariadb-errmsg - update to 10.5.29-2.0.1
mariadb-embedded-devel - update to 10.5.29-2.0.1
mariadb-embedded - update to 10.5.29-2.0.1
mariadb-devel - update to 10.5.29-2.0.1
mariadb-common - update to 10.5.29-2.0.1
mariadb-backup - update to 10.5.29-2.0.1
mariadb-test - update to 10.5.29-2.0.1
mariadb - update to 10.5.29-2.0.1
libmariadbd19 - addressed in versions 10.5.29-150300.3.55.1, 10.6.23-150400.3.40.1, 10.11.14-150600.4.14.1
mariadb-client-debuginfo - addressed in versions 10.5.29-150300.3.55.1, 10.6.23-150400.3.40.1, 10.11.14-150600.4.14.1
mariadb-debugsource - addressed in versions 10.5.29-150300.3.55.1, 10.6.23-150400.3.40.1, 10.11.14-150600.4.14.1
mariadb-errormessages - addressed in versions 10.5.29-150300.3.55.1, 10.6.23-150400.3.40.1, 10.11.14-150600.4.14.1
mariadb-rpm-macros - addressed in versions 10.5.29-150300.3.55.1, 10.6.23-150400.3.40.1, 10.11.14-150600.4.14.1
mariadb-bench-debuginfo - addressed in versions 10.5.29-150300.3.55.1, 10.6.23-150400.3.40.1, 10.11.14-150600.4.14.1
mariadb-galera - addressed in versions 10.5.29-150300.3.55.1, 10.6.23-150400.3.40.1, 10.11.14-150600.4.14.1
libmariadbd-devel - addressed in versions 10.5.29-150300.3.55.1, 10.6.23-150400.3.40.1, 10.11.14-150600.4.14.1
mariadb-test-debuginfo - addressed in versions 10.5.29-150300.3.55.1, 10.6.23-150400.3.40.1, 10.11.14-150600.4.14.1
mariadb-client - addressed in versions 10.5.29-150300.3.55.1, 10.6.23-150400.3.40.1, 10.11.14-150600.4.14.1
mariadb-debuginfo - addressed in versions 10.5.29-150300.3.55.1, 10.6.23-150400.3.40.1, 10.11.14-150600.4.14.1
mariadb - addressed in versions 10.5.29-150300.3.55.1, 10.6.23-150400.3.40.1, 10.11.14-150600.4.14.1
mariadb-tools - addressed in versions 10.5.29-150300.3.55.1, 10.6.23-150400.3.40.1, 10.11.14-150600.4.14.1
libmariadbd19-debuginfo - addressed in versions 10.5.29-150300.3.55.1, 10.6.23-150400.3.40.1, 10.11.14-150600.4.14.1
mariadb-bench - addressed in versions 10.5.29-150300.3.55.1, 10.6.23-150400.3.40.1, 10.11.14-150600.4.14.1
mariadb-test - addressed in versions 10.5.29-150300.3.55.1, 10.6.23-150400.3.40.1, 10.11.14-150600.4.14.1
mariadb-tools-debuginfo - addressed in versions 10.5.29-150300.3.55.1, 10.6.23-150400.3.40.1, 10.11.14-150600.4.14.1
mariadb-10.6 (Ubuntu package) - update to 1:10.6.22-0ubuntu0.22.04.1
mariadb10.11 - addressed in versions 10.11.11-1.fc40, 10.11.11-1.fc41
mariadb (Ubuntu package) - addressed in versions 1:10.11.13-0ubuntu0.24.04.1, 1:11.4.7-0ubuntu0.25.04.1
mariadb10.11 (Red Hat package) - update to 10.11.15-1.el10_1
galera - update to 26.4.22-1
galera (Red Hat package) - update to 26.4.22-1.el9_6

• https://jira.mariadb.org/browse/MDEV-32083

• Multiple DoS vulnerabilities in MariaDB Server
• Slackware Linux update for mariadb
• openEuler 22.03 LTS SP3 update for mariadb
• openEuler 24.03 LTS SP1 update for mariadb
• openEuler 22.03 LTS SP4 update for mariadb
• openEuler 24.03 LTS update for mariadb
• Red Hat Enterprise Linux 8 update for the mariadb:10.5 module
• Red Hat Enterprise Linux 9 update for multiple packages
• SUSE update for mariadb
• SUSE update for mariadb
• Anolis OS update for mariadb:10.5 module
• Ubuntu update for mariadb-10.6
• Fedora 41 update for mariadb10.11
• Fedora 40 update for mariadb10.11
• Red Hat Enterprise Linux 10 update for mariadb10.11
• SUSE update for mariadb
• Red Hat Enterprise Linux 9 update for the mariadb:10.11 module
• Ubuntu update for mariadb
• Multiple vulnerabilities in IBM Cloud Object System