Improper input validation in MySQL Server - CVE-2024-21096

Vulnerability identifier: #VU88696

CSH Severity: Low

CVSS v4: 2.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-21096

CWE-ID: CWE-20

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Client: mysqldump component in MySQL Server. A local non-authenticated attacker can exploit this vulnerability to read and manipulate data.

MySQL Server
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Performance Computing LTSS 15
Galera for Ericsson 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Linux Enterprise Micro
Anolis OS
SUSE Enterprise Storage
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for ARM 64
Slackware Linux
SUSE Linux Enterprise Server 15 SP3 LTSS
SUSE Linux Enterprise Server 15 SP4 LTSS
SUSE Package Hub 15
Server Applications Module
openSUSE Leap
openEuler
Ubuntu
Fedora
IBM Observability with Instana
SmartFabric Storage Software
postgres-decoderbufs
Judy-devel
Judy
pgaudit
pg_repack
asio-devel
mysql
mysql-libs
mysql-config
mysql-common
mysql-help
mysql-devel
mysql-debuginfo
mysql-test
mysql-errmsg
mysql-server
mysql-debugsource
postgresql
postgresql-contrib
postgresql-devel
postgresql-docs
postgresql-libs
postgresql-plperl
postgresql-plpython
postgresql-pltcl
postgresql-server
postgresql-test
mariadb-backup
mariadb-test
mariadb-server-utils
mariadb-server-galera
mariadb-server
mariadb-rocksdb-engine
mariadb-pam
mariadb-oqgraph-engine
mariadb-gssapi-server
mariadb-errmsg
mariadb-embedded-devel
mariadb-embedded
mariadb-devel
mariadb-debugsource
mariadb-debuginfo
mariadb-config
mariadb-common
mariadb
mariadb-client-debuginfo
mariadb-galera
libmariadbd19-debuginfo
mariadb-tools-debuginfo
mariadb-test-debuginfo
mariadb-rpm-macros
mariadb-tools
mariadb-client
mariadb-bench
libmariadbd19
mariadb-bench-debuginfo
libmariadbd-devel
mariadb-errormessages
mariadb (Red Hat package)
mariadb10.11
postgresql-test-rpm-macros
postgresql-upgrade-devel
postgresql-upgrade
postgresql-static
postgresql-server-devel
postgresql-plpython3
postgresql-debugsource
postgresql-debuginfo
postgresql-private-libs
postgresql-llvmjit
postgresql-private-devel
libpq-devel
libpq-debugsource
libpq-debuginfo
libpq
galera
galera (Red Hat package)
mysql-server-8.0 (Ubuntu package)
mariadb-server (Ubuntu package)
Planning Analytics Local
OpenManage Network Integration (OMNI)

Install updates from vendor's website.

IBM Observability with Instana - update to 1.0.309
SmartFabric Storage Software - update to 1.4.3
postgres-decoderbufs - update to 0.10.0-2
Judy-devel - update to 1.0.5-18
Judy - update to 1.0.5-18
pgaudit - update to 1.4.0-7
pg_repack - update to 1.4.6-3
asio-devel - update to 1.10.8-7
mysql - addressed in versions 8.0.37-1, 8.0.37-2, 8.0.38-1
mysql-libs - addressed in versions 8.0.37-1, 8.0.37-2, 8.0.38-1
mysql-config - addressed in versions 8.0.37-1, 8.0.37-2, 8.0.38-1
mysql-common - addressed in versions 8.0.37-1, 8.0.37-2, 8.0.38-1
mysql-help - addressed in versions 8.0.37-1, 8.0.37-2, 8.0.38-1
mysql-devel - addressed in versions 8.0.37-1, 8.0.37-2, 8.0.38-1
mysql-debuginfo - addressed in versions 8.0.37-1, 8.0.37-2, 8.0.38-1
mysql-test - addressed in versions 8.0.37-1, 8.0.37-2, 8.0.38-1
mysql-errmsg - addressed in versions 8.0.37-1, 8.0.37-2, 8.0.38-1
mysql-server - addressed in versions 8.0.37-1, 8.0.37-2, 8.0.38-1
mysql-test - update to 8.0.37-1
mysql-server - update to 8.0.37-1
mysql-libs - update to 8.0.37-1
mysql-errmsg - update to 8.0.37-1
mysql-devel - update to 8.0.37-1
mysql-common - update to 8.0.37-1
mysql - update to 8.0.37-1
mysql-debugsource - addressed in versions 8.0.37-1, 8.0.37-2, 8.0.38-1
postgresql - addressed in versions 9.2.24-9, 12.22-5.0.1, 12.22-12.0.1, 13.22-1.0.1, 15.14-1, 15.14-1.0.1
postgresql-contrib - addressed in versions 9.2.24-9, 12.22-5.0.1, 12.22-12.0.1, 13.22-1.0.1, 15.14-1, 15.14-1.0.1
postgresql-devel - update to 9.2.24-9
postgresql-docs - addressed in versions 9.2.24-9, 12.22-5.0.1, 12.22-12.0.1, 13.22-1.0.1, 15.14-1, 15.14-1.0.1
postgresql-libs - update to 9.2.24-9
postgresql-plperl - addressed in versions 9.2.24-9, 12.22-5.0.1, 12.22-12.0.1, 13.22-1.0.1, 15.14-1, 15.14-1.0.1
postgresql-plpython - update to 9.2.24-9
postgresql-pltcl - addressed in versions 9.2.24-9, 12.22-5.0.1, 12.22-12.0.1, 13.22-1.0.1, 15.14-1, 15.14-1.0.1
postgresql-server - addressed in versions 9.2.24-9, 12.22-5.0.1, 12.22-12.0.1, 13.22-1.0.1, 15.14-1, 15.14-1.0.1
postgresql-test - addressed in versions 9.2.24-9, 12.22-5.0.1, 12.22-12.0.1, 13.22-1.0.1, 15.14-1, 15.14-1.0.1
mariadb-backup - addressed in versions 10.5.25-1, 10.5.29-1
mariadb-test - addressed in versions 10.5.25-1, 10.5.29-1
mariadb-server-utils - addressed in versions 10.5.25-1, 10.5.29-1
mariadb-server-galera - addressed in versions 10.5.25-1, 10.5.29-1
mariadb-server - addressed in versions 10.5.25-1, 10.5.29-1
mariadb-rocksdb-engine - addressed in versions 10.5.25-1, 10.5.29-1
mariadb-pam - addressed in versions 10.5.25-1, 10.5.29-1
mariadb-oqgraph-engine - addressed in versions 10.5.25-1, 10.5.29-1
mariadb-gssapi-server - addressed in versions 10.5.25-1, 10.5.29-1
mariadb-errmsg - addressed in versions 10.5.25-1, 10.5.29-1
mariadb-embedded-devel - addressed in versions 10.5.25-1, 10.5.29-1
mariadb-embedded - addressed in versions 10.5.25-1, 10.5.29-1
mariadb-devel - addressed in versions 10.5.25-1, 10.5.29-1
mariadb-debugsource - addressed in versions 10.5.25-1, 10.5.29-1
mariadb-debuginfo - addressed in versions 10.5.25-1, 10.5.29-1
mariadb-config - addressed in versions 10.5.25-1, 10.5.29-1
mariadb-common - addressed in versions 10.5.25-1, 10.5.29-1
mariadb - addressed in versions 10.5.25-1, 10.5.29-1
mariadb - update to 10.5.25-1.fc39
mariadb-client-debuginfo - addressed in versions 10.5.26-150300.3.46.1, 10.6.18-150400.3.33.1, 10.11.8-150600.4.3.1
mariadb-galera - addressed in versions 10.5.26-150300.3.46.1, 10.6.18-150400.3.33.1, 10.11.8-150600.4.3.1
mariadb-test - addressed in versions 10.5.26-150300.3.46.1, 10.6.18-150400.3.33.1, 10.11.8-150600.4.3.1
libmariadbd19-debuginfo - addressed in versions 10.5.26-150300.3.46.1, 10.6.18-150400.3.33.1, 10.11.8-150600.4.3.1
mariadb-debugsource - addressed in versions 10.5.26-150300.3.46.1, 10.6.18-150400.3.33.1, 10.11.8-150600.4.3.1
mariadb-tools-debuginfo - addressed in versions 10.5.26-150300.3.46.1, 10.6.18-150400.3.33.1, 10.11.8-150600.4.3.1
mariadb-debuginfo - addressed in versions 10.5.26-150300.3.46.1, 10.6.18-150400.3.33.1, 10.11.8-150600.4.3.1
mariadb-test-debuginfo - addressed in versions 10.5.26-150300.3.46.1, 10.6.18-150400.3.33.1, 10.11.8-150600.4.3.1
mariadb-rpm-macros - addressed in versions 10.5.26-150300.3.46.1, 10.6.18-150400.3.33.1, 10.11.8-150600.4.3.1
mariadb-tools - addressed in versions 10.5.26-150300.3.46.1, 10.6.18-150400.3.33.1, 10.11.8-150600.4.3.1
mariadb-client - addressed in versions 10.5.26-150300.3.46.1, 10.6.18-150400.3.33.1, 10.11.8-150600.4.3.1
mariadb-bench - addressed in versions 10.5.26-150300.3.46.1, 10.6.18-150400.3.33.1, 10.11.8-150600.4.3.1
libmariadbd19 - addressed in versions 10.5.26-150300.3.46.1, 10.6.18-150400.3.33.1, 10.11.8-150600.4.3.1
mariadb-bench-debuginfo - addressed in versions 10.5.26-150300.3.46.1, 10.6.18-150400.3.33.1, 10.11.8-150600.4.3.1
libmariadbd-devel - addressed in versions 10.5.26-150300.3.46.1, 10.6.18-150400.3.33.1, 10.11.8-150600.4.3.1
mariadb - addressed in versions 10.5.26-150300.3.46.1, 10.6.18-150400.3.33.1, 10.11.8-150600.4.3.1
mariadb-errormessages - addressed in versions 10.5.26-150300.3.46.1, 10.6.18-150400.3.33.1, 10.11.8-150600.4.3.1
mariadb (Red Hat package) - update to 10.5.27-1.el9_5
mariadb-oqgraph-engine - update to 10.5.27-1.0.1
mariadb-test - update to 10.5.27-1.0.1
mariadb-gssapi-server - update to 10.5.27-1.0.1
mariadb-errmsg - update to 10.5.27-1.0.1
mariadb-embedded-devel - update to 10.5.27-1.0.1
mariadb - update to 10.5.27-1.0.1
mariadb-backup - update to 10.5.27-1.0.1
mariadb-common - update to 10.5.27-1.0.1
mariadb-devel - update to 10.5.27-1.0.1
mariadb-embedded - update to 10.5.27-1.0.1
mariadb-pam - update to 10.5.27-1.0.1
mariadb-server - update to 10.5.27-1.0.1
mariadb-server-galera - update to 10.5.27-1.0.1
mariadb-server-utils - update to 10.5.27-1.0.1
mariadb10.11 - update to 10.11.8-1.fc40
postgresql-test-rpm-macros - addressed in versions 12.22-5.0.1, 12.22-12.0.1, 13.22-1.0.1, 15.14-1, 15.14-1.0.1
postgresql-upgrade-devel - addressed in versions 12.22-5.0.1, 12.22-12.0.1, 13.22-1.0.1, 15.14-1, 15.14-1.0.1
postgresql-upgrade - addressed in versions 12.22-5.0.1, 12.22-12.0.1, 13.22-1.0.1, 15.14-1, 15.14-1.0.1
postgresql-static - addressed in versions 12.22-5.0.1, 12.22-12.0.1, 13.22-1.0.1, 15.14-1, 15.14-1.0.1
postgresql-server-devel - addressed in versions 12.22-5.0.1, 12.22-12.0.1, 13.22-1.0.1, 15.14-1, 15.14-1.0.1
postgresql-plpython3 - addressed in versions 12.22-5.0.1, 12.22-12.0.1, 13.22-1.0.1, 15.14-1, 15.14-1.0.1
postgresql - addressed in versions 13.22-1, 15.14-1
postgresql-debugsource - addressed in versions 13.22-1, 15.14-1
postgresql-debuginfo - addressed in versions 13.22-1, 15.14-1
postgresql-contrib - addressed in versions 13.22-1, 15.14-1
postgresql-test-rpm-macros - addressed in versions 13.22-1, 15.14-1
postgresql-test - addressed in versions 13.22-1, 15.14-1
postgresql-static - addressed in versions 13.22-1, 15.14-1
postgresql-server-devel - addressed in versions 13.22-1, 15.14-1
postgresql-server - addressed in versions 13.22-1, 15.14-1
postgresql-private-libs - addressed in versions 13.22-1, 15.14-1
postgresql-docs - addressed in versions 13.22-1, 15.14-1
postgresql-llvmjit - addressed in versions 13.22-1, 15.14-1
postgresql-plperl - addressed in versions 13.22-1, 15.14-1
postgresql-plpython3 - addressed in versions 13.22-1, 15.14-1
postgresql-pltcl - addressed in versions 13.22-1, 15.14-1
postgresql-private-devel - addressed in versions 13.22-1, 15.14-1
libpq-devel - addressed in versions 13.22-1, 15.14-1
libpq-debugsource - addressed in versions 13.22-1, 15.14-1
libpq-debuginfo - addressed in versions 13.22-1, 15.14-1
libpq - addressed in versions 13.22-1, 15.14-1
postgresql-private-devel - addressed in versions 15.14-1, 15.14-1.0.1
postgresql-private-libs - addressed in versions 15.14-1, 15.14-1.0.1
galera - addressed in versions 26.4.18-1.fc39, 26.4.18-1.fc40
galera - update to 26.4.20-1
galera (Red Hat package) - update to 26.4.20-1.el9_5
Planning Analytics Local - update to 2.1.5
OpenManage Network Integration (OMNI) - update to 3.7
mariadb - update to 10.5.25
mysql-server-8.0 (Ubuntu package) - addressed in versions 8.0.37-0ubuntu0.20.04.3, 8.0.37-0ubuntu0.22.04.3, 8.0.37-0ubuntu0.23.10.2, 8.0.37-0ubuntu0.24.04.1
mariadb-server (Ubuntu package) - addressed in versions 1:10.6.18-0ubuntu0.22.04.1, 1:10.11.8-0ubuntu0.23.10.1, 1:10.11.8-0ubuntu0.24.04.1

• https://www.oracle.com/security-alerts/cpuapr2024.html

• Multiple vulnerabilities in MySQL Server
• openEuler 22.03 LTS SP2 update for mysql
• openEuler 22.03 LTS SP3 update for mysql
• openEuler 22.03 LTS update for mysql
• openEuler 22.03 LTS SP1 update for mysql
• Fedora 40 update for galera, mariadb10.11
• Fedora 39 update for galera, mariadb
• SUSE update for mariadb
• Ubuntu update for mysql-8.0
• SUSE update for mariadb
• Ubuntu update for mariadb
• openEuler 24.03 LTS update for mysql
• Slackware Linux update for mariadb
• SUSE update for mariadb
• openEuler 20.03 LTS SP4 update for mysql
• Multiple vulnerabilities in IBM Planning Analytics
• Multiple vulnerabilities in Dell OpenManage Network Integration (OMNI)
• Red Hat Enterprise Linux 8 update for the mariadb:10.11 module
• Red Hat Enterprise Linux 8 update for the mariadb:10.5 module
• Red Hat Enterprise Linux 9 update for the mariadb:10.11 module
• Red Hat Enterprise Linux 9 update for galera and mariadb
• Anolis OS update for mysql
• Anolis OS update for mysql
• Anolis OS update for mariadb:10.5 module
• Dell SmartFabric Storage Software update for third-party components
• openEuler 22.03 LTS SP3 update for mariadb
• Anolis OS update for postgresql:15 module
• Anolis OS update for postgresql:13 module
• Anolis OS update for postgresql:12 module
• openEuler 24.03 LTS SP2 update for postgresql
• openEuler 24.03 LTS SP1 update for postgresql
• openEuler 22.03 LTS SP4 update for postgresql
• openEuler 22.03 LTS SP3 update for postgresql
• openEuler 24.03 LTS SP2 update for libpq
• openEuler 24.03 LTS SP1 update for libpq
• openEuler 22.03 LTS SP4 update for libpq
• openEuler 22.03 LTS SP3 update for libpq
• openEuler 24.03 LTS update for libpq
• openEuler 24.03 LTS update for postgresql
• Anolis OS update for postgresql
• Multiple vulnerabilities in IBM Observability with Instana
• openEuler 24.03 LTS update for mariadb
• Anolis OS update for postgresql
• Anolis OS update for postgresql module