Improper input validation in MySQL Server - CVE-2021-22570

Vulnerability identifier: #VU62403

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-22570

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server: Compiling (protobuf) component in MySQL Server. A remote non-authenticated attacker can exploit this vulnerability to perform a denial of service (DoS) attack.

MySQL Server
Oracle Linux
Amazon Linux AMI
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Desktop 15
SUSE Manager Proxy
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE CaaS Platform
SUSE Linux Enterprise Module for SUSE Manager Server
SUSE Linux Enterprise Micro
Fedora
SUSE Linux Enterprise Storage
SUSE Enterprise Storage
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat CodeReady Linux Builder for x86_64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for ARM 64
Red Hat CodeReady Linux Builder for IBM z Systems
Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support
Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support
Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Ubuntu
SUSE Linux Enterprise Server 15 SP1 LTSS
SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS
Public Cloud Module
SUSE Linux Enterprise Installer
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Realtime Extension
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Server 15 SP2 LTSS
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
SUSE Linux Enterprise Module for Public Cloud
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Module for Development Tools
SUSE Linux Enterprise Module for Basesystem
SUSE Linux Enterprise Server 15 SP3 LTSS
Basesystem Module
Server Applications Module
SUSE Package Hub 15
openSUSE Leap
openEuler
ObjectScale
Operations Analytics - Log Analysis
PowerStore T
Dell EMC PowerStore Family Operating System
IBM Business Automation Manager Open Editions
Netcool Operations Insight
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
Red Hat OpenStack
Red Hat OpenShift Container Platform
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
SUSE Linux Enterprise Module for Packagehub Subpackages
libprotoc8 (Ubuntu package)
libprotobuf8 (Ubuntu package)
libprotobuf-lite8 (Ubuntu package)
protobuf-compiler (Ubuntu package)
python3-opencensus-ext-threading
python3-opencensus-context
python3-aiocontextvars
python2-grpcio-gcp
python3-grpcio-gcp
python3-Automat
python3-pytest-asyncio
python3-opencensus
python3-knack
python3-Deprecated
python3-jsondiff
python2-jsondiff
python3-websocket-client
python3-opentelemetry-api
python2-googleapis-common-protos
python3-googleapis-common-protos
python3-avro
python3-google-api-core
grpc-debuginfo
grpc-debugsource
libgrpc++1-debuginfo
grpc-source
python3-grpcio-debuginfo
grpc-devel-debuginfo
libgrpc8-debuginfo
python2-grpcio-debuginfo
python2-grpcio
grpc-devel
python3-grpcio
libgrpc8
libgrpc++1
python3-PyGithub
protobuf
libprotobuf-lite9v5 (Ubuntu package)
libprotobuf9v5 (Ubuntu package)
libprotoc9v5 (Ubuntu package)
azure-cli-core
python2-requests
python3-requests
python3-protobuf (Ubuntu package)
python-protobuf (Ubuntu package)
libprotoc10 (Ubuntu package)
libprotobuf10 (Ubuntu package)
libprotobuf-lite10 (Ubuntu package)
python2-cryptography-vectors
python3-cryptography-vectors
python2-cryptography
python3-cryptography
python-cryptography-debuginfo
python2-cryptography-debuginfo
python-cryptography-debugsource
python3-cryptography-debuginfo
protobuf (Red Hat package)
libprotoc17 (Ubuntu package)
libprotoc-dev (Ubuntu package)
libprotobuf-lite17 (Ubuntu package)
protobuf-devel-debuginfo
protobuf-devel
protobuf-java
libprotoc20
python3-protobuf
libprotobuf20-debuginfo
libprotobuf20
python2-protobuf
libprotobuf-lite20
libprotoc20-debuginfo
libprotobuf-lite20-debuginfo
protobuf-debugsource
libprotobuf20-32bit
libprotobuf-lite20-32bit
protobuf-source
libprotoc20-32bit
python3-pytest
libprotobuf-java (Ubuntu package)
libprotobuf23 (Ubuntu package)
libprotobuf-lite23 (Ubuntu package)
libprotoc23 (Ubuntu package)
mingw-protobuf
protobuf-lite
protobuf-lite-devel
protobuf-bom
protobuf-debuginfo
protobuf-compiler
protobuf-javalite
protobuf-javadoc
protobuf-java-util
protobuf-parent
python-zope.interface-debuginfo
python-zope.interface-debugsource
python3-zope.interface
python3-zope.interface-debuginfo
python3-psutil
python-psutil-debugsource
python3-psutil-debuginfo
python2-psutil
python2-psutil-debuginfo
python-psutil-debuginfo
mysql-errmsg
mysql-test
mysql-server
mysql-libs
mysql-help
mysql-devel
mysql-debugsource
mysql-debuginfo
mysql-common
mysql
mysql-config
python-websockets-debugsource
python3-websockets-debuginfo
python3-websockets
python2-humanfriendly
python3-humanfriendly
python3-constantly
python3-hyperlink
python3-incremental
python3-Twisted
python3-Twisted-debuginfo
chromium
Splunk Enterprise

Install updates from vendor's website.

ObjectScale - update to 1.3.0
Operations Analytics - Log Analysis - update to 1.3.8.0
Netcool Operations Insight - update to 1.6.15
Red Hat OpenShift Container Platform - addressed in versions 4.11.20, 4.12.0
Splunk Enterprise - addressed in versions 9.0.7, 9.1.2
libprotoc8 (Ubuntu package) - update to Ubuntu Pro
libprotobuf8 (Ubuntu package) - update to Ubuntu Pro
libprotobuf-lite8 (Ubuntu package) - update to Ubuntu Pro
protobuf-compiler (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 2.6.11.3ubuntu0.1~esm1, 3.0.0-9.1ubuntu1.1, 3.6.1.3-2ubuntu5.2, 3.12.4-1ubuntu7.22.04.1, 3.12.4-1ubuntu7.22.10.1
python3-opencensus-ext-threading - update to 0.1.2-150100.3.3.3
python3-opencensus-context - update to 0.1.2-150100.3.3.3
python3-aiocontextvars - update to 0.2.2-150100.3.3.3
python2-grpcio-gcp - update to 0.2.2-150100.3.3.3
python3-grpcio-gcp - update to 0.2.2-150100.3.3.3
python3-Automat - update to 0.6.0-150000.3.4.1
python3-pytest-asyncio - update to 0.8.0-150100.3.3.3
python3-opencensus - update to 0.8.0-150100.3.3.3
python3-knack - update to 0.9.0-150100.3.7.3
python3-Deprecated - update to 1.2.13-150100.3.3.3
python3-jsondiff - update to 1.3.0-150100.3.6.3
python2-jsondiff - update to 1.3.0-150100.3.6.3
python3-websocket-client - update to 1.3.2-150100.6.7.3
python3-opentelemetry-api - update to 1.5.0-150100.3.3.3
python2-googleapis-common-protos - update to 1.6.0-150100.3.3.3
python3-googleapis-common-protos - update to 1.6.0-150100.3.3.3
python3-avro - update to 1.11.0-150100.3.3.3
python3-google-api-core - update to 1.14.2-150100.3.3.3
grpc-debuginfo - update to 1.25.0-150100.3.3.3
grpc-debugsource - update to 1.25.0-150100.3.3.3
libgrpc++1-debuginfo - update to 1.25.0-150100.3.3.3
grpc-source - update to 1.25.0-150100.3.3.3
python3-grpcio-debuginfo - update to 1.25.0-150100.3.3.3
grpc-devel-debuginfo - update to 1.25.0-150100.3.3.3
libgrpc8-debuginfo - update to 1.25.0-150100.3.3.3
python2-grpcio-debuginfo - update to 1.25.0-150100.3.3.3
python2-grpcio - update to 1.25.0-150100.3.3.3
grpc-devel - update to 1.25.0-150100.3.3.3
python3-grpcio - update to 1.25.0-150100.3.3.3
libgrpc8 - update to 1.25.0-150100.3.3.3
libgrpc++1 - update to 1.25.0-150100.3.3.3
python3-PyGithub - update to 1.43.5-150100.3.3.3
protobuf - addressed in versions 2.5.0-1.11, 3.14.0-7
libprotobuf-lite9v5 (Ubuntu package) - update to 2.6.11.3ubuntu0.1~esm1
libprotobuf9v5 (Ubuntu package) - update to 2.6.11.3ubuntu0.1~esm1
libprotoc9v5 (Ubuntu package) - update to 2.6.11.3ubuntu0.1~esm1
azure-cli-core - update to 2.17.1-150100.6.18.1
python2-requests - update to 2.25.1-150100.6.13.3
python3-requests - update to 2.25.1-150100.6.13.3
python3-protobuf (Ubuntu package) - addressed in versions 3.0.0-9.1ubuntu1.1, 3.6.1.3-2ubuntu5.2, 3.12.4-1ubuntu7.22.04.1, 3.12.4-1ubuntu7.22.10.1
python-protobuf (Ubuntu package) - addressed in versions 3.0.0-9.1ubuntu1.1, 3.6.1.3-2ubuntu5.2
libprotoc10 (Ubuntu package) - update to 3.0.0-9.1ubuntu1.1
libprotobuf10 (Ubuntu package) - update to 3.0.0-9.1ubuntu1.1
libprotobuf-lite10 (Ubuntu package) - update to 3.0.0-9.1ubuntu1.1
python2-cryptography-vectors - update to 3.3.2-150100.3.11.3
python3-cryptography-vectors - update to 3.3.2-150100.3.11.3
python2-cryptography - update to 3.3.2-150100.7.15.3
python3-cryptography - update to 3.3.2-150100.7.15.3
python-cryptography-debuginfo - update to 3.3.2-150100.7.15.3
python2-cryptography-debuginfo - update to 3.3.2-150100.7.15.3
python-cryptography-debugsource - update to 3.3.2-150100.7.15.3
python3-cryptography-debuginfo - update to 3.3.2-150100.7.15.3
PowerStore T - update to 3.5.0.1-2083289
protobuf (Red Hat package) - addressed in versions 3.5.0-15.el8, 3.5.0-15.el8_6, 3.6.1-6.el8ost, 3.14.0-13.el9
libprotoc17 (Ubuntu package) - update to 3.6.1.3-2ubuntu5.2
libprotoc-dev (Ubuntu package) - update to 3.6.1.3-2ubuntu5.2
libprotobuf-lite17 (Ubuntu package) - update to 3.6.1.3-2ubuntu5.2
protobuf-devel-debuginfo - addressed in versions 3.9.2-4.12.1, 3.9.2-150100.8.3.3
protobuf-devel - addressed in versions 3.9.2-4.12.1, 3.9.2-150100.8.3.3
protobuf-java - addressed in versions 3.9.2-4.12.1, 3.9.2-150100.8.3.3
libprotoc20 - addressed in versions 3.9.2-4.12.1, 3.9.2-150100.8.3.3
python3-protobuf - addressed in versions 3.9.2-4.12.1, 3.9.2-150100.8.3.3
libprotobuf20-debuginfo - addressed in versions 3.9.2-4.12.1, 3.9.2-150100.8.3.3
libprotobuf20 - addressed in versions 3.9.2-4.12.1, 3.9.2-150100.8.3.3
python2-protobuf - addressed in versions 3.9.2-4.12.1, 3.9.2-150100.8.3.3
libprotobuf-lite20 - addressed in versions 3.9.2-4.12.1, 3.9.2-150100.8.3.3
libprotoc20-debuginfo - addressed in versions 3.9.2-4.12.1, 3.9.2-150100.8.3.3
libprotobuf-lite20-debuginfo - addressed in versions 3.9.2-4.12.1, 3.9.2-150100.8.3.3
protobuf-debugsource - addressed in versions 3.9.2-4.12.1, 3.9.2-150100.8.3.3
libprotobuf20-32bit - update to 3.9.2-150100.8.3.3
libprotobuf-lite20-32bit - update to 3.9.2-150100.8.3.3
protobuf-source - update to 3.9.2-150100.8.3.3
libprotoc20-32bit - update to 3.9.2-150100.8.3.3
python3-pytest - update to 3.10.1-150000.7.5.1
libprotobuf-java (Ubuntu package) - addressed in versions 3.12.4-1ubuntu7.22.04.1, 3.12.4-1ubuntu7.22.10.1
libprotobuf23 (Ubuntu package) - addressed in versions 3.12.4-1ubuntu7.22.04.1, 3.12.4-1ubuntu7.22.10.1
libprotobuf-lite23 (Ubuntu package) - addressed in versions 3.12.4-1ubuntu7.22.04.1, 3.12.4-1ubuntu7.22.10.1
libprotoc23 (Ubuntu package) - addressed in versions 3.12.4-1ubuntu7.22.04.1, 3.12.4-1ubuntu7.22.10.1
mingw-protobuf - addressed in versions 3.14.0-4.fc34, 3.14.0-4.fc35
protobuf-devel - update to 3.14.0-6
protobuf - update to 3.14.0-6
protobuf-lite - update to 3.14.0-6
protobuf-lite-devel - update to 3.14.0-6
protobuf-bom - update to 3.14.0-6
protobuf-debugsource - update to 3.14.0-6
protobuf-debuginfo - update to 3.14.0-6
protobuf-compiler - update to 3.14.0-6
protobuf-javalite - update to 3.14.0-6
protobuf-javadoc - update to 3.14.0-6
protobuf-java-util - update to 3.14.0-6
python3-protobuf - update to 3.14.0-6
protobuf-java - update to 3.14.0-6
protobuf-parent - update to 3.14.0-6
protobuf - addressed in versions 3.14.0-7.fc34, 3.14.0-7.fc35
Dell EMC PowerStore Family Operating System - update to 4.0.0.0-2284811
python-zope.interface-debuginfo - update to 4.4.2-150000.3.4.1
python-zope.interface-debugsource - update to 4.4.2-150000.3.4.1
python3-zope.interface - update to 4.4.2-150000.3.4.1
python3-zope.interface-debuginfo - update to 4.4.2-150000.3.4.1
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 4.7
python3-psutil - update to 5.9.1-150100.6.6.3
python-psutil-debugsource - update to 5.9.1-150100.6.6.3
python3-psutil-debuginfo - update to 5.9.1-150100.6.6.3
python2-psutil - update to 5.9.1-150100.6.6.3
python2-psutil-debuginfo - update to 5.9.1-150100.6.6.3
python-psutil-debuginfo - update to 5.9.1-150100.6.6.3
IBM Business Automation Manager Open Editions - update to 8.0.6
mysql-errmsg - update to 8.0.38-1
mysql-test - update to 8.0.38-1
mysql-server - update to 8.0.38-1
mysql-libs - update to 8.0.38-1
mysql-help - update to 8.0.38-1
mysql-devel - update to 8.0.38-1
mysql-debugsource - update to 8.0.38-1
mysql-debuginfo - update to 8.0.38-1
mysql-common - update to 8.0.38-1
mysql - update to 8.0.38-1
mysql-config - update to 8.0.38-1
python-websockets-debugsource - update to 9.1-150100.3.3.3
python3-websockets-debuginfo - update to 9.1-150100.3.3.3
python3-websockets - update to 9.1-150100.3.3.3
python2-humanfriendly - update to 10.0-150100.6.3.3
python3-humanfriendly - update to 10.0-150100.6.3.3
python3-constantly - update to 15.1.0-150000.3.4.1
Red Hat OpenStack - addressed in versions 16.1.9, 16.2.4
python3-hyperlink - update to 17.2.1-150000.3.4.1
python3-incremental - update to 17.5.0-150000.3.4.1
python3-Twisted - update to 17.9.0-150000.3.8.1
python3-Twisted-debuginfo - update to 17.9.0-150000.3.8.1
chromium - addressed in versions 99.0.4844.51-1.el7, 99.0.4844.51-1.el8, 99.0.4844.51-1.fc34, 99.0.4844.51-1.fc35, 99.0.4844.51-1.fc36

• https://www.oracle.com/security-alerts/cpuapr2022.html

• Multiple vulnerabilities in MySQL Server
• Ubuntu update for protobuf
• SUSE update for protobuf
• Red Hat Enterprise Linux 8 update for protobuf
• Red Hat Enterprise Linux 9 update for protobuf
• Red Hat OpenStack Platform 16.2 update for protobuf
• Red Hat OpenStack Platform 16.1 update for protobuf
• Multiple vulnerabilities in OpenShift Container Platform 4.11
• Multiple vulnerabilities in OpenShift Container Platform 4.12
• Amazon Linux AMI update for protobuf
• Ubuntu update for protobuf
• SUSE update for protobuf
• SUSE update for protobuf
• SUSE update for grpc, protobuf, python-Deprecated, python-PyGithub, python-aiocontextvars, python-avro, python-bcrypt, python-cryptography, python-cryptography-vectors, python-google-api-core, pyt
• Improper input validation in IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
• Multiple vulnerabilities in Oracle Linux
• Multiple vulnerabilities in Dell PowerStore Family
• SUSE update for grpc, protobuf, python-Deprecated, python-PyGithub, python-aiocontextvars, python-avro, python-bcrypt, python-cryptography, python-cryptography-vectors, python-google-api-core, pyt
• Splunk Enterprise update for third-party components
• openEuler 20.03 LTS SP1 update for protobuf
• Red Hat Enterprise Linux 8.6 Extended Update Support update for protobuf
• Multiple vulnerabilities in Dell PowerStore Family
• Amazon Linux AMI update for protobuf
• openEuler 20.03 LTS SP4 update for mysql
• Multiple vulnerabilities in IBM Business Automation Manager Open Editions
• Fedora 35 update for protobuf
• Fedora 34 update for protobuf
• Fedora 34 update for mingw-protobuf
• Fedora 35 update for mingw-protobuf
• Fedora 34 update for chromium
• Fedora 35 update for chromium
• Fedora 36 update for chromium
• Fedora EPEL 8 update for chromium
• Fedora EPEL 7 update for chromium
• Multiple vulnerabilities in Dell ObjectScale
• Multiple vulnerabilities in Netcool Operations Insight
• IBM Operations Analytics - Log Analysis update for Nullptr