Command Injection in MariaDB - CVE-2021-27928

Vulnerability identifier: #VU51645

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-27928

CWE-ID: CWE-77

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to execute arbitrary commands on the target system.

The vulnerability exists due to improper input validation in the "wsrep_provider" and "wsrep_notify_cmd" parameters. A remote attacker can pass specially crafted data to the application and execute arbitrary commands on the target system.

MariaDB
Gentoo Linux
Anolis OS
Red Hat CodeReady Linux Builder for ARM 64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for x86_64
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support
Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support
Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support
Red Hat Enterprise Linux Server - TUS
SUSE OpenStack Cloud Crowbar
SUSE OpenStack Cloud
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Server
SUSE Linux Enterprise Module for Server Applications
openEuler
Red Hat Software Collections
PowerVC
Red Hat OpenStack
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
Red Hat Enterprise Linux Server for x86_64 - Update Services for SAP Solutions
rh-mariadb103-mariadb (Red Hat package)
rh-mariadb103-galera (Red Hat package)
Judy
mariadb (Red Hat package)
mariadb-tools-debuginfo
mariadb-errormessages
mariadb-tools
mariadb-galera
mariadb-debugsource
mariadb-debuginfo
mariadb-client-debuginfo
mariadb-client
mariadb
mariadb-test
mariadb-errmessage
mariadb-embedded-devel
mariadb-backup
mariadb-server-galera
mariadb-devel
mariadb-server
mariadb-gssapi-server
mariadb-embedded
mariadb-oqgraph-engine
mariadb-cracklib
mariadb-common
mariadb-errmsg
mariadb-server-utils
galera

Install updates from vendor's website.

MariaDB - addressed in versions 10.2.37, 10.3.28, 10.4.18, 10.5.9
rh-mariadb103-mariadb (Red Hat package) - update to 10.3.28-2.el7
rh-mariadb103-galera (Red Hat package) - update to 25.3.32-2.el7
Judy - update to 1.0.5-18
mariadb (Red Hat package) - update to 10.1.20-3.el7ost
mariadb-tools-debuginfo - update to 10.2.39-3.36.1
mariadb-errormessages - update to 10.2.39-3.36.1
mariadb-tools - update to 10.2.39-3.36.1
mariadb-galera - update to 10.2.39-3.36.1
mariadb-debugsource - update to 10.2.39-3.36.1
mariadb-debuginfo - update to 10.2.39-3.36.1
mariadb-client-debuginfo - update to 10.2.39-3.36.1
mariadb-client - update to 10.2.39-3.36.1
mariadb - update to 10.2.39-3.36.1
mariadb-debugsource - update to 10.3.9-11
mariadb-test - update to 10.3.9-11
mariadb-errmessage - update to 10.3.9-11
mariadb-embedded-devel - update to 10.3.9-11
mariadb-debuginfo - update to 10.3.9-11
mariadb-backup - update to 10.3.9-11
mariadb-server-galera - update to 10.3.9-11
mariadb-devel - update to 10.3.9-11
mariadb-server - update to 10.3.9-11
mariadb-gssapi-server - update to 10.3.9-11
mariadb-embedded - update to 10.3.9-11
mariadb-oqgraph-engine - update to 10.3.9-11
mariadb-cracklib - update to 10.3.9-11
mariadb-common - update to 10.3.9-11
mariadb - update to 10.3.9-11
mariadb-gssapi-server - update to 10.3.28-1
mariadb-embedded-devel - update to 10.3.28-1
mariadb-errmsg - update to 10.3.28-1
mariadb-test - update to 10.3.28-1
mariadb-oqgraph-engine - update to 10.3.28-1
mariadb-server - update to 10.3.28-1
mariadb-server-galera - update to 10.3.28-1
mariadb-server-utils - update to 10.3.28-1
mariadb-embedded - update to 10.3.28-1
mariadb-devel - update to 10.3.28-1
mariadb-common - update to 10.3.28-1
mariadb-backup - update to 10.3.28-1
mariadb - update to 10.3.28-1
Red Hat OpenStack - update to 13.0
galera - update to 25.3.32-1

• Exploit #7660 - CVE-2021-27928 (Pasos a seguir para explotar la vulnerabilidad CVE-2021-27928) (April 15, 2022)
• Exploit #7124 - CVE-2021-27928-POC (CVE-2021-27928-POC) (December 9, 2021)
• Exploit #6445 - CVE-2021-27928 (A remote code execution issue was discovered in MariaDB 10.2 before 10.2.37, 10.3 before 10.3.28, 10.4 before 10.4.18, and 10.5 before 10.5.9; Percona Server through 2021-03-03; and the wsrep patch through 2021-03-03 for MySQL. An untruste (June 20, 2021)
• Exploit #5616 - MariaDB 10.2 /MySQL - 'wsrep_provider' OS Command Execution (June 17, 2021)
• Exploit #5452 - CVE-2021-27928 (CVE-2021-27928 MariaDB/MySQL-'wsrep provider' 命令注入漏洞) (May 20, 2021)
• Exploit #5298 - MariaDB 10.2 Command Execution (April 16, 2021)

• https://jira.mariadb.org/browse/MDEV-25179
• https://lists.debian.org/debian-lts-announce/2021/03/msg00028.html
• https://mariadb.com/kb/en/mariadb-10237-release-notes/
• https://mariadb.com/kb/en/mariadb-10328-release-notes/
• https://mariadb.com/kb/en/mariadb-10418-release-notes/
• https://mariadb.com/kb/en/mariadb-1059-release-notes/
• https://mariadb.com/kb/en/security/
• https://github.com/LalieA/CVE-2021-27928

• Command Injection in MariaDB
• Red Hat Enterprise Linux 8.1 update for the mariadb:10.3 and mariadb-devel:10.3 modules
• Red Hat Enterprise Linux 8 update for the mariadb:10.3 and mariadb-devel:10.3 modules
• Red Hat Enterprise Linux 8.2 update for the mariadb:10.3 and mariadb-devel:10.3 modules
• Red Hat Software Collections update for rh-mariadb103-mariadb and rh-mariadb103-galera
• Gentoo update for MariaDB
• SUSE Linux Enterprise Module for Server Applications update for mariadb
• SUSE Linux Enterprise Module for Server Applications update for mariadb
• SUSE Linux Enterprise Server update for mariadb
• SUSE update for mariadb
• openEuler 20.03 LTS SP1 update for mariadb
• Command Injection in Red Hat OpenStack packages
• IBM PowerVC update for MariaDB
• Anolis OS update for mariadb:10.3 module