Vulnerability-Lookup

ALSA-2025:1673

Vulnerability from osv_almalinux – Published: 2025-02-19 00:00 – Updated: 2025-02-20 11:16 – Source website

Summary

Important: mysql:8.0 security update

Details

MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon (mysqld) and many client programs and libraries.

Security Fix(es):

openssl: SSL_select_next_proto buffer overread (CVE-2024-5535)
krb5: GSS message token handling (CVE-2024-37371)
curl: libcurl: ASN.1 date parser overread (CVE-2024-7264)
mysql: Thread Pooling unspecified vulnerability (CPU Oct 2024) (CVE-2024-21238)
mysql: X Plugin unspecified vulnerability (CPU Oct 2024) (CVE-2024-21196)
mysql: Optimizer unspecified vulnerability (CPU Oct 2024) (CVE-2024-21241)
mysql: Client programs unspecified vulnerability (CPU Oct 2024) (CVE-2024-21231)
mysql: Information Schema unspecified vulnerability (CPU Oct 2024) (CVE-2024-21197)
mysql: InnoDB unspecified vulnerability (CPU Oct 2024) (CVE-2024-21218)
mysql: Optimizer unspecified vulnerability (CPU Oct 2024) (CVE-2024-21201)
mysql: InnoDB unspecified vulnerability (CPU Oct 2024) (CVE-2024-21236)
mysql: Group Replication GCS unspecified vulnerability (CPU Oct 2024) (CVE-2024-21237)
mysql: FTS unspecified vulnerability (CPU Oct 2024) (CVE-2024-21203)
mysql: Health Monitor unspecified vulnerability (CPU Oct 2024) (CVE-2024-21212)
mysql: DML unspecified vulnerability (CPU Oct 2024) (CVE-2024-21219)
mysql: Optimizer unspecified vulnerability (CPU Oct 2024) (CVE-2024-21230)
mysql: InnoDB unspecified vulnerability (CPU Oct 2024) (CVE-2024-21213)
mysql: InnoDB unspecified vulnerability (CPU Oct 2024) (CVE-2024-21194)
mysql: InnoDB unspecified vulnerability (CPU Oct 2024) (CVE-2024-21199)
mysql: PS unspecified vulnerability (CPU Oct 2024) (CVE-2024-21193)
mysql: DDL unspecified vulnerability (CPU Oct 2024) (CVE-2024-21198)
mysql: mysqldump unspecified vulnerability (CPU Oct 2024) (CVE-2024-21247)
mysql: InnoDB unspecified vulnerability (CPU Oct 2024) (CVE-2024-21239)
curl: curl netrc password leak (CVE-2024-11053)
mysql: InnoDB unspecified vulnerability (CPU Jan 2025) (CVE-2025-21497)
mysql: MySQL Server Options Vulnerability (CVE-2025-21520)
mysql: High Privilege Denial of Service Vulnerability in MySQL Server (CVE-2025-21490)
mysql: Information Schema unspecified vulnerability (CPU Jan 2025) (CVE-2025-21529)
mysql: InnoDB unspecified vulnerability (CPU Jan 2025) (CVE-2025-21531)
mysql: Optimizer unspecified vulnerability (CPU Jan 2025) (CVE-2025-21504)
mysql: Privileges unspecified vulnerability (CPU Jan 2025) (CVE-2025-21540)
mysql: MySQL Server InnoDB Denial of Service and Unauthorized Data Modification Vulnerability (CVE-2025-21555)
mysql: Packaging unspecified vulnerability (CPU Jan 2025) (CVE-2025-21543)
mysql: MySQL Server InnoDB Denial of Service and Unauthorized Data Modification Vulnerability (CVE-2025-21491)
mysql: DDL unspecified vulnerability (CPU Jan 2025) (CVE-2025-21525)
mysql: Optimizer unspecified vulnerability (CPU Jan 2025) (CVE-2025-21536)
mysql: Thread Pooling unspecified vulnerability (CPU Jan 2025) (CVE-2025-21521)
mysql: Optimizer unspecified vulnerability (CPU Jan 2025) (CVE-2025-21501)
mysql: Performance Schema unspecified vulnerability (CPU Jan 2025) (CVE-2025-21534)
mysql: Privileges unspecified vulnerability (CPU Jan 2025) (CVE-2025-21494)
mysql: Privileges unspecified vulnerability (CPU Jan 2025) (CVE-2025-21519)
mysql: Parser unspecified vulnerability (CPU Jan 2025) (CVE-2025-21522)
mysql: InnoDB unspecified vulnerability (CPU Jan 2025) (CVE-2025-21503)
mysql: Optimizer unspecified vulnerability (CPU Jan 2025) (CVE-2025-21518)
mysql: MySQL Server InnoDB Denial of Service and Unauthorized Data Modification Vulnerability (CVE-2025-21559)
mysql: Privilege Misuse in MySQL Server Security Component (CVE-2025-21546)
mysql: Optimizer unspecified vulnerability (CPU Jan 2025) (CVE-2025-21500)
mysql: InnoDB unspecified vulnerability (CPU Jan 2025) (CVE-2025-21523)
mysql: Components Services unspecified vulnerability (CPU Jan 2025) (CVE-2025-21505)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References

URL

Type

	https://access.redhat.com/errata/RHSA-2025:1673	ADVISORY
	https://access.redhat.com/security/cve/CVE-2024-11053	REPORT
	https://access.redhat.com/security/cve/CVE-2024-21193	REPORT
	https://access.redhat.com/security/cve/CVE-2024-21194	REPORT
	https://access.redhat.com/security/cve/CVE-2024-21196	REPORT
	https://access.redhat.com/security/cve/CVE-2024-21197	REPORT
	https://access.redhat.com/security/cve/CVE-2024-21198	REPORT
	https://access.redhat.com/security/cve/CVE-2024-21199	REPORT
	https://access.redhat.com/security/cve/CVE-2024-21201	REPORT
	https://access.redhat.com/security/cve/CVE-2024-21203	REPORT
	https://access.redhat.com/security/cve/CVE-2024-21212	REPORT
	https://access.redhat.com/security/cve/CVE-2024-21213	REPORT
	https://access.redhat.com/security/cve/CVE-2024-21218	REPORT
	https://access.redhat.com/security/cve/CVE-2024-21219	REPORT
	https://access.redhat.com/security/cve/CVE-2024-21230	REPORT
	https://access.redhat.com/security/cve/CVE-2024-21231	REPORT
	https://access.redhat.com/security/cve/CVE-2024-21236	REPORT
	https://access.redhat.com/security/cve/CVE-2024-21237	REPORT
	https://access.redhat.com/security/cve/CVE-2024-21238	REPORT
	https://access.redhat.com/security/cve/CVE-2024-21239	REPORT
	https://access.redhat.com/security/cve/CVE-2024-21241	REPORT
	https://access.redhat.com/security/cve/CVE-2024-21247	REPORT
	https://access.redhat.com/security/cve/CVE-2024-37371	REPORT
	https://access.redhat.com/security/cve/CVE-2024-5535	REPORT
	https://access.redhat.com/security/cve/CVE-2024-7264	REPORT
	https://access.redhat.com/security/cve/CVE-2025-21490	REPORT
	https://access.redhat.com/security/cve/CVE-2025-21491	REPORT
	https://access.redhat.com/security/cve/CVE-2025-21494	REPORT
	https://access.redhat.com/security/cve/CVE-2025-21497	REPORT
	https://access.redhat.com/security/cve/CVE-2025-21500	REPORT
	https://access.redhat.com/security/cve/CVE-2025-21501	REPORT
	https://access.redhat.com/security/cve/CVE-2025-21503	REPORT
	https://access.redhat.com/security/cve/CVE-2025-21504	REPORT
	https://access.redhat.com/security/cve/CVE-2025-21505	REPORT
	https://access.redhat.com/security/cve/CVE-2025-21518	REPORT
	https://access.redhat.com/security/cve/CVE-2025-21519	REPORT
	https://access.redhat.com/security/cve/CVE-2025-21520	REPORT
	https://access.redhat.com/security/cve/CVE-2025-21521	REPORT
	https://access.redhat.com/security/cve/CVE-2025-21522	REPORT
	https://access.redhat.com/security/cve/CVE-2025-21523	REPORT
	https://access.redhat.com/security/cve/CVE-2025-21525	REPORT
	https://access.redhat.com/security/cve/CVE-2025-21529	REPORT
	https://access.redhat.com/security/cve/CVE-2025-21531	REPORT
	https://access.redhat.com/security/cve/CVE-2025-21534	REPORT
	https://access.redhat.com/security/cve/CVE-2025-21536	REPORT
	https://access.redhat.com/security/cve/CVE-2025-21540	REPORT
	https://access.redhat.com/security/cve/CVE-2025-21543	REPORT
	https://access.redhat.com/security/cve/CVE-2025-21546	REPORT
	https://access.redhat.com/security/cve/CVE-2025-21555	REPORT
	https://access.redhat.com/security/cve/CVE-2025-21559	REPORT
	https://bugzilla.redhat.com/2294581	REPORT
	https://bugzilla.redhat.com/2294676	REPORT
	https://bugzilla.redhat.com/2301888	REPORT
	https://bugzilla.redhat.com/2318857	REPORT
	https://bugzilla.redhat.com/2318858	REPORT
	https://bugzilla.redhat.com/2318870	REPORT
	https://bugzilla.redhat.com/2318873	REPORT
	https://bugzilla.redhat.com/2318874	REPORT
	https://bugzilla.redhat.com/2318876	REPORT
	https://bugzilla.redhat.com/2318882	REPORT
	https://bugzilla.redhat.com/2318883	REPORT
	https://bugzilla.redhat.com/2318884	REPORT
	https://bugzilla.redhat.com/2318885	REPORT
	https://bugzilla.redhat.com/2318886	REPORT
	https://bugzilla.redhat.com/2318897	REPORT
	https://bugzilla.redhat.com/2318900	REPORT
	https://bugzilla.redhat.com/2318905	REPORT
	https://bugzilla.redhat.com/2318914	REPORT
	https://bugzilla.redhat.com/2318922	REPORT
	https://bugzilla.redhat.com/2318923	REPORT
	https://bugzilla.redhat.com/2318925	REPORT
	https://bugzilla.redhat.com/2318926	REPORT
	https://bugzilla.redhat.com/2318927	REPORT
	https://bugzilla.redhat.com/2331191	REPORT
	https://bugzilla.redhat.com/2339218	REPORT
	https://bugzilla.redhat.com/2339220	REPORT
	https://bugzilla.redhat.com/2339221	REPORT
	https://bugzilla.redhat.com/2339226	REPORT
	https://bugzilla.redhat.com/2339231	REPORT
	https://bugzilla.redhat.com/2339236	REPORT
	https://bugzilla.redhat.com/2339238	REPORT
	https://bugzilla.redhat.com/2339243	REPORT
	https://bugzilla.redhat.com/2339247	REPORT
	https://bugzilla.redhat.com/2339252	REPORT
	https://bugzilla.redhat.com/2339259	REPORT
	https://bugzilla.redhat.com/2339266	REPORT
	https://bugzilla.redhat.com/2339270	REPORT
	https://bugzilla.redhat.com/2339271	REPORT
	https://bugzilla.redhat.com/2339275	REPORT
	https://bugzilla.redhat.com/2339277	REPORT
	https://bugzilla.redhat.com/2339281	REPORT
	https://bugzilla.redhat.com/2339284	REPORT
	https://bugzilla.redhat.com/2339291	REPORT
	https://bugzilla.redhat.com/2339293	REPORT
	https://bugzilla.redhat.com/2339295	REPORT
	https://bugzilla.redhat.com/2339299	REPORT
	https://bugzilla.redhat.com/2339300	REPORT
	https://bugzilla.redhat.com/2339304	REPORT
	https://bugzilla.redhat.com/2339305	REPORT
	https://errata.almalinux.org/8/ALSA-2025-1673.html	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "mecab"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.996-2.module_el8.10.0+3965+b415b607"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "mecab"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.996-2.module_el8.6.0+3340+d764b636"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "mecab-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.996-2.module_el8.10.0+3965+b415b607"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "mecab-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.996-2.module_el8.6.0+3340+d764b636"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "mecab-ipadic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.7.0.20070801-17.module_el8.10.0+3965+b415b607"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "mecab-ipadic-EUCJP"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.7.0.20070801-17.module_el8.10.0+3965+b415b607"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "mysql"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.0.41-1.module_el8.10.0+3965+b415b607"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "mysql-common"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.0.41-1.module_el8.10.0+3965+b415b607"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "mysql-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.0.41-1.module_el8.10.0+3965+b415b607"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "mysql-errmsg"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.0.41-1.module_el8.10.0+3965+b415b607"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "mysql-libs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.0.41-1.module_el8.10.0+3965+b415b607"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "mysql-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.0.41-1.module_el8.10.0+3965+b415b607"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "mysql-test"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.0.41-1.module_el8.10.0+3965+b415b607"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon (mysqld) and many client programs and libraries.  \n\nSecurity Fix(es):  \n\n  * openssl: SSL_select_next_proto buffer overread (CVE-2024-5535)\n  * krb5: GSS message token handling (CVE-2024-37371)\n  * curl: libcurl: ASN.1 date parser overread (CVE-2024-7264)\n  * mysql: Thread Pooling unspecified vulnerability (CPU Oct 2024) (CVE-2024-21238)\n  * mysql: X Plugin unspecified vulnerability (CPU Oct 2024) (CVE-2024-21196)\n  * mysql: Optimizer unspecified vulnerability (CPU Oct 2024) (CVE-2024-21241)\n  * mysql: Client programs unspecified vulnerability (CPU Oct 2024) (CVE-2024-21231)\n  * mysql: Information Schema unspecified vulnerability (CPU Oct 2024) (CVE-2024-21197)\n  * mysql: InnoDB unspecified vulnerability (CPU Oct 2024) (CVE-2024-21218)\n  * mysql: Optimizer unspecified vulnerability (CPU Oct 2024) (CVE-2024-21201)\n  * mysql: InnoDB unspecified vulnerability (CPU Oct 2024) (CVE-2024-21236)\n  * mysql: Group Replication GCS unspecified vulnerability (CPU Oct 2024) (CVE-2024-21237)\n  * mysql: FTS unspecified vulnerability (CPU Oct 2024) (CVE-2024-21203)\n  * mysql: Health Monitor unspecified vulnerability (CPU Oct 2024) (CVE-2024-21212)\n  * mysql: DML unspecified vulnerability (CPU Oct 2024) (CVE-2024-21219)\n  * mysql: Optimizer unspecified vulnerability (CPU Oct 2024) (CVE-2024-21230)\n  * mysql: InnoDB unspecified vulnerability (CPU Oct 2024) (CVE-2024-21213)\n  * mysql: InnoDB unspecified vulnerability (CPU Oct 2024) (CVE-2024-21194)\n  * mysql: InnoDB unspecified vulnerability (CPU Oct 2024) (CVE-2024-21199)\n  * mysql: PS unspecified vulnerability (CPU Oct 2024) (CVE-2024-21193)\n  * mysql: DDL unspecified vulnerability (CPU Oct 2024) (CVE-2024-21198)\n  * mysql: mysqldump unspecified vulnerability (CPU Oct 2024) (CVE-2024-21247)\n  * mysql: InnoDB unspecified vulnerability (CPU Oct 2024) (CVE-2024-21239)\n  * curl: curl netrc password leak (CVE-2024-11053)\n  * mysql: InnoDB unspecified vulnerability (CPU Jan 2025) (CVE-2025-21497)\n  * mysql: MySQL Server Options Vulnerability (CVE-2025-21520)\n  * mysql: High Privilege Denial of Service Vulnerability in MySQL Server (CVE-2025-21490)\n  * mysql: Information Schema unspecified vulnerability (CPU Jan 2025) (CVE-2025-21529)\n  * mysql: InnoDB unspecified vulnerability (CPU Jan 2025) (CVE-2025-21531)\n  * mysql: Optimizer unspecified vulnerability (CPU Jan 2025) (CVE-2025-21504)\n  * mysql: Privileges unspecified vulnerability (CPU Jan 2025) (CVE-2025-21540)\n  * mysql: MySQL Server InnoDB Denial of Service and Unauthorized Data Modification Vulnerability (CVE-2025-21555)\n  * mysql: Packaging unspecified vulnerability (CPU Jan 2025) (CVE-2025-21543)\n  * mysql: MySQL Server InnoDB Denial of Service and Unauthorized Data Modification Vulnerability (CVE-2025-21491)\n  * mysql: DDL unspecified vulnerability (CPU Jan 2025) (CVE-2025-21525)\n  * mysql: Optimizer unspecified vulnerability (CPU Jan 2025) (CVE-2025-21536)\n  * mysql: Thread Pooling unspecified vulnerability (CPU Jan 2025) (CVE-2025-21521)\n  * mysql: Optimizer unspecified vulnerability (CPU Jan 2025) (CVE-2025-21501)\n  * mysql: Performance Schema unspecified vulnerability (CPU Jan 2025) (CVE-2025-21534)\n  * mysql: Privileges unspecified vulnerability (CPU Jan 2025) (CVE-2025-21494)\n  * mysql: Privileges unspecified vulnerability (CPU Jan 2025) (CVE-2025-21519)\n  * mysql: Parser unspecified vulnerability (CPU Jan 2025) (CVE-2025-21522)\n  * mysql: InnoDB unspecified vulnerability (CPU Jan 2025) (CVE-2025-21503)\n  * mysql: Optimizer unspecified vulnerability (CPU Jan 2025) (CVE-2025-21518)\n  * mysql: MySQL Server InnoDB Denial of Service and Unauthorized Data Modification Vulnerability (CVE-2025-21559)\n  * mysql: Privilege Misuse in MySQL Server Security Component (CVE-2025-21546)\n  * mysql: Optimizer unspecified vulnerability (CPU Jan 2025) (CVE-2025-21500)\n  * mysql: InnoDB unspecified vulnerability (CPU Jan 2025) (CVE-2025-21523)\n  * mysql: Components Services unspecified vulnerability (CPU Jan 2025) (CVE-2025-21505)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n",
  "id": "ALSA-2025:1673",
  "modified": "2025-02-20T11:16:10Z",
  "published": "2025-02-19T00:00:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://access.redhat.com/errata/RHSA-2025:1673"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2024-11053"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2024-21193"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2024-21194"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2024-21196"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2024-21197"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2024-21198"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2024-21199"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2024-21201"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2024-21203"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2024-21212"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2024-21213"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2024-21218"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2024-21219"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2024-21230"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2024-21231"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2024-21236"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2024-21237"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2024-21238"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2024-21239"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2024-21241"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2024-21247"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2024-37371"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2024-5535"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2024-7264"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2025-21490"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2025-21491"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2025-21494"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2025-21497"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2025-21500"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2025-21501"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2025-21503"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2025-21504"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2025-21505"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2025-21518"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2025-21519"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2025-21520"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2025-21521"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2025-21522"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2025-21523"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2025-21525"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2025-21529"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2025-21531"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2025-21534"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2025-21536"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2025-21540"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2025-21543"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2025-21546"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2025-21555"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2025-21559"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2294581"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2294676"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2301888"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2318857"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2318858"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2318870"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2318873"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2318874"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2318876"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2318882"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2318883"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2318884"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2318885"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2318886"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2318897"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2318900"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2318905"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2318914"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2318922"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2318923"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2318925"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2318926"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2318927"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2331191"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2339218"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2339220"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2339221"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2339226"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2339231"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2339236"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2339238"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2339243"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2339247"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2339252"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2339259"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2339266"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2339270"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2339271"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2339275"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2339277"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2339281"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2339284"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2339291"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2339293"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2339295"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2339299"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2339300"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2339304"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2339305"
    },
    {
      "type": "ADVISORY",
      "url": "https://errata.almalinux.org/8/ALSA-2025-1673.html"
    }
  ],
  "related": [
    "CVE-2024-5535",
    "CVE-2024-37371",
    "CVE-2024-7264",
    "CVE-2024-21238",
    "CVE-2024-21196",
    "CVE-2024-21241",
    "CVE-2024-21231",
    "CVE-2024-21197",
    "CVE-2024-21218",
    "CVE-2024-21201",
    "CVE-2024-21236",
    "CVE-2024-21237",
    "CVE-2024-21203",
    "CVE-2024-21212",
    "CVE-2024-21219",
    "CVE-2024-21230",
    "CVE-2024-21213",
    "CVE-2024-21194",
    "CVE-2024-21199",
    "CVE-2024-21193",
    "CVE-2024-21198",
    "CVE-2024-21247",
    "CVE-2024-21239",
    "CVE-2024-11053",
    "CVE-2025-21497",
    "CVE-2025-21520",
    "CVE-2025-21490",
    "CVE-2025-21529",
    "CVE-2025-21531",
    "CVE-2025-21504",
    "CVE-2025-21540",
    "CVE-2025-21555",
    "CVE-2025-21543",
    "CVE-2025-21491",
    "CVE-2025-21525",
    "CVE-2025-21536",
    "CVE-2025-21521",
    "CVE-2025-21501",
    "CVE-2025-21534",
    "CVE-2025-21494",
    "CVE-2025-21519",
    "CVE-2025-21522",
    "CVE-2025-21503",
    "CVE-2025-21518",
    "CVE-2025-21559",
    "CVE-2025-21546",
    "CVE-2025-21500",
    "CVE-2025-21523",
    "CVE-2025-21505"
  ],
  "summary": "Important: mysql:8.0 security update"
}

CVE-2024-21213 (GCVE-0-2024-21213)

Vulnerability from cvelistv5 – Published: 2024-10-15 19:52 – Updated: 2025-11-03 21:53

Summary

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and 9.0.1 and prior. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.2 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H).

Severity

4.2 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-10-16 14:36 UTC

CWE

Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.
CWE-noinfo Not enough information

Assigner

oracle mitre root

References

2 references

URL	Tags
https://www.oracle.com/security-alerts/cpuoct2024.html	vendor-advisory
https://security.netapp.com/advisory/ntap-2024102…

Impacted products

1 product

Vendor	Product	Version
Oracle Corporation	MySQL Server	Affected: * , ≤ 8.0.39 (custom) Affected: * , ≤ 8.4.2 (custom) Affected: * , ≤ 9.0.1 (custom) cpe:2.3:a:oracle:mysql_server:8.0.39_and_prior:::::::* cpe:2.3:a:oracle:mysql_server:8.4.2_and_prior:::::::* cpe:2.3:a:oracle:mysql_server:9.0.1_and_prior:::::::*

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-21213",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-16T14:36:32.280194Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-25T16:38:35.492Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T21:53:01.413Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://security.netapp.com/advisory/ntap-20241025-0006/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:oracle:mysql_server:8.0.39_and_prior:*:*:*:*:*:*:*",
            "cpe:2.3:a:oracle:mysql_server:8.4.2_and_prior:*:*:*:*:*:*:*",
            "cpe:2.3:a:oracle:mysql_server:9.0.1_and_prior:*:*:*:*:*:*:*"
          ],
          "product": "MySQL Server",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "lessThanOrEqual": "8.0.39",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "8.4.2",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "9.0.1",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and  9.0.1 and prior. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.2 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 4.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.",
              "lang": "en-US"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-10-15T19:52:42.559Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "Oracle Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2024.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2024-21213",
    "datePublished": "2024-10-15T19:52:42.559Z",
    "dateReserved": "2023-12-07T22:28:10.690Z",
    "dateUpdated": "2025-11-03T21:53:01.413Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-21218 (GCVE-0-2024-21218)

Vulnerability from cvelistv5 – Published: 2024-10-15 19:52 – Updated: 2025-11-03 21:53

Summary

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and 9.0.1 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

Severity

4.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-10-17 13:44 UTC

CWE

Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Cluster.
CWE-400 - Uncontrolled Resource Consumption

Assigner

oracle mitre root

References

2 references

URL	Tags
https://www.oracle.com/security-alerts/cpuoct2024.html	vendor-advisory
https://security.netapp.com/advisory/ntap-2024102…

Impacted products

2 products

Vendor	Product	Version
Oracle Corporation	MySQL Cluster	Affected: * , ≤ 7.5.35 (custom) Affected: * , ≤ 7.6.31 (custom) Affected: * , ≤ 8.0.39 (custom) Affected: * , ≤ 8.4.2 (custom) Affected: * , ≤ 9.0.1 (custom) cpe:2.3:a:oracle:mysql_cluster:7.5.35_and_prior:::::::* cpe:2.3:a:oracle:mysql_cluster:7.6.31_and_prior:::::::* cpe:2.3:a:oracle:mysql_cluster:8.0.39_and_prior:::::::* cpe:2.3:a:oracle:mysql_cluster:8.4.2_and_prior:::::::* cpe:2.3:a:oracle:mysql_cluster:9.0.1_and_prior:::::::*
Oracle Corporation	MySQL Server	Affected: * , ≤ 8.0.39 (custom) Affected: * , ≤ 8.4.2 (custom) Affected: * , ≤ 9.0.1 (custom) cpe:2.3:a:oracle:mysql_server:8.0.39_and_prior:::::::* cpe:2.3:a:oracle:mysql_server:8.4.2_and_prior:::::::* cpe:2.3:a:oracle:mysql_server:9.0.1_and_prior:::::::*

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-21218",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-17T13:44:06.112045Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-400",
                "description": "CWE-400 Uncontrolled Resource Consumption",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-13T15:35:27.998Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T21:53:05.825Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://security.netapp.com/advisory/ntap-20241025-0006/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:oracle:mysql_cluster:7.5.35_and_prior:*:*:*:*:*:*:*",
            "cpe:2.3:a:oracle:mysql_cluster:7.6.31_and_prior:*:*:*:*:*:*:*",
            "cpe:2.3:a:oracle:mysql_cluster:8.0.39_and_prior:*:*:*:*:*:*:*",
            "cpe:2.3:a:oracle:mysql_cluster:8.4.2_and_prior:*:*:*:*:*:*:*",
            "cpe:2.3:a:oracle:mysql_cluster:9.0.1_and_prior:*:*:*:*:*:*:*"
          ],
          "product": "MySQL Cluster",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "lessThanOrEqual": "7.5.35",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "7.6.31",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "8.0.39",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "8.4.2",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "9.0.1",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:oracle:mysql_server:8.0.39_and_prior:*:*:*:*:*:*:*",
            "cpe:2.3:a:oracle:mysql_server:8.4.2_and_prior:*:*:*:*:*:*:*",
            "cpe:2.3:a:oracle:mysql_server:9.0.1_and_prior:*:*:*:*:*:*:*"
          ],
          "product": "MySQL Server",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "lessThanOrEqual": "8.0.39",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "8.4.2",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "9.0.1",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and  9.0.1 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Cluster.",
              "lang": "en-US"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-10-15T19:52:44.128Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "Oracle Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2024.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2024-21218",
    "datePublished": "2024-10-15T19:52:44.128Z",
    "dateReserved": "2023-12-07T22:28:10.691Z",
    "dateUpdated": "2025-11-03T21:53:05.825Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-21219 (GCVE-0-2024-21219)

Vulnerability from cvelistv5 – Published: 2024-10-15 19:52 – Updated: 2025-11-03 21:53

Summary

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and 9.0.1 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

Severity

4.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-10-17 13:43 UTC

CWE

Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.
CWE-400 - Uncontrolled Resource Consumption

Assigner

oracle mitre root

References

2 references

URL	Tags
https://www.oracle.com/security-alerts/cpuoct2024.html	vendor-advisory
https://security.netapp.com/advisory/ntap-2024102…

Impacted products

1 product

Vendor	Product	Version
Oracle Corporation	MySQL Server	Affected: * , ≤ 8.0.39 (custom) Affected: * , ≤ 8.4.2 (custom) Affected: * , ≤ 9.0.1 (custom) cpe:2.3:a:oracle:mysql_server:8.0.39_and_prior:::::::* cpe:2.3:a:oracle:mysql_server:8.4.2_and_prior:::::::* cpe:2.3:a:oracle:mysql_server:9.0.1_and_prior:::::::*

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-21219",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-17T13:43:46.388365Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-400",
                "description": "CWE-400 Uncontrolled Resource Consumption",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-13T15:51:42.145Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T21:53:07.283Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://security.netapp.com/advisory/ntap-20241025-0006/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:oracle:mysql_server:8.0.39_and_prior:*:*:*:*:*:*:*",
            "cpe:2.3:a:oracle:mysql_server:8.4.2_and_prior:*:*:*:*:*:*:*",
            "cpe:2.3:a:oracle:mysql_server:9.0.1_and_prior:*:*:*:*:*:*:*"
          ],
          "product": "MySQL Server",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "lessThanOrEqual": "8.0.39",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "8.4.2",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "9.0.1",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML).  Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and  9.0.1 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.",
              "lang": "en-US"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-10-15T19:52:44.460Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "Oracle Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2024.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2024-21219",
    "datePublished": "2024-10-15T19:52:44.460Z",
    "dateReserved": "2023-12-07T22:28:10.691Z",
    "dateUpdated": "2025-11-03T21:53:07.283Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-21230 (GCVE-0-2024-21230)

Vulnerability from cvelistv5 – Published: 2024-10-15 19:52 – Updated: 2025-11-03 21:53

Summary

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and 9.0.1 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-10-17 13:43 UTC

CWE

Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Cluster.
CWE-400 - Uncontrolled Resource Consumption

Assigner

oracle mitre root

References

2 references

URL	Tags
https://www.oracle.com/security-alerts/cpuoct2024.html	vendor-advisory
https://security.netapp.com/advisory/ntap-2024102…

Impacted products

2 products

Vendor	Product	Version
Oracle Corporation	MySQL Cluster	Affected: * , ≤ 7.5.35 (custom) Affected: * , ≤ 7.6.31 (custom) Affected: * , ≤ 8.0.39 (custom) Affected: * , ≤ 8.4.2 (custom) Affected: * , ≤ 9.0.1 (custom) cpe:2.3:a:oracle:mysql_cluster:7.5.35_and_prior:::::::* cpe:2.3:a:oracle:mysql_cluster:7.6.31_and_prior:::::::* cpe:2.3:a:oracle:mysql_cluster:8.0.39_and_prior:::::::* cpe:2.3:a:oracle:mysql_cluster:8.4.2_and_prior:::::::* cpe:2.3:a:oracle:mysql_cluster:9.0.1_and_prior:::::::*
Oracle Corporation	MySQL Server	Affected: * , ≤ 8.0.39 (custom) Affected: * , ≤ 8.4.2 (custom) Affected: * , ≤ 9.0.1 (custom) cpe:2.3:a:oracle:mysql_server:8.0.39_and_prior:::::::* cpe:2.3:a:oracle:mysql_server:8.4.2_and_prior:::::::* cpe:2.3:a:oracle:mysql_server:9.0.1_and_prior:::::::*

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-21230",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-17T13:43:08.519772Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-400",
                "description": "CWE-400 Uncontrolled Resource Consumption",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-13T15:25:45.161Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T21:53:08.748Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://security.netapp.com/advisory/ntap-20241025-0006/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:oracle:mysql_cluster:7.5.35_and_prior:*:*:*:*:*:*:*",
            "cpe:2.3:a:oracle:mysql_cluster:7.6.31_and_prior:*:*:*:*:*:*:*",
            "cpe:2.3:a:oracle:mysql_cluster:8.0.39_and_prior:*:*:*:*:*:*:*",
            "cpe:2.3:a:oracle:mysql_cluster:8.4.2_and_prior:*:*:*:*:*:*:*",
            "cpe:2.3:a:oracle:mysql_cluster:9.0.1_and_prior:*:*:*:*:*:*:*"
          ],
          "product": "MySQL Cluster",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "lessThanOrEqual": "7.5.35",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "7.6.31",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "8.0.39",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "8.4.2",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "9.0.1",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:oracle:mysql_server:8.0.39_and_prior:*:*:*:*:*:*:*",
            "cpe:2.3:a:oracle:mysql_server:8.4.2_and_prior:*:*:*:*:*:*:*",
            "cpe:2.3:a:oracle:mysql_server:9.0.1_and_prior:*:*:*:*:*:*:*"
          ],
          "product": "MySQL Server",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "lessThanOrEqual": "8.0.39",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "8.4.2",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "9.0.1",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and  9.0.1 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Cluster.",
              "lang": "en-US"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-10-15T19:52:45.238Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "Oracle Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2024.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2024-21230",
    "datePublished": "2024-10-15T19:52:45.238Z",
    "dateReserved": "2023-12-07T22:28:10.693Z",
    "dateUpdated": "2025-11-03T21:53:08.748Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-21231 (GCVE-0-2024-21231)

Vulnerability from cvelistv5 – Published: 2024-10-15 19:52 – Updated: 2025-11-03 21:53

Summary

Vulnerability in the MySQL Server product of Oracle MySQL (component: Client programs). Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and 9.0.1 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server. CVSS 3.1 Base Score 3.1 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L).

Severity

3.1 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-10-17 13:42 UTC

CWE

Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server.
CWE-400 - Uncontrolled Resource Consumption

Assigner

oracle mitre root

References

2 references

URL	Tags
https://www.oracle.com/security-alerts/cpuoct2024.html	vendor-advisory
https://security.netapp.com/advisory/ntap-2024102…

Impacted products

1 product

Vendor	Product	Version
Oracle Corporation	MySQL Server	Affected: * , ≤ 8.0.39 (custom) Affected: * , ≤ 8.4.2 (custom) Affected: * , ≤ 9.0.1 (custom) cpe:2.3:a:oracle:mysql_server:8.0.39_and_prior:::::::* cpe:2.3:a:oracle:mysql_server:8.4.2_and_prior:::::::* cpe:2.3:a:oracle:mysql_server:9.0.1_and_prior:::::::*

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-21231",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-17T13:42:42.853283Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-400",
                "description": "CWE-400 Uncontrolled Resource Consumption",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-13T13:33:32.263Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T21:53:10.198Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://security.netapp.com/advisory/ntap-20241025-0006/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:oracle:mysql_server:8.0.39_and_prior:*:*:*:*:*:*:*",
            "cpe:2.3:a:oracle:mysql_server:8.4.2_and_prior:*:*:*:*:*:*:*",
            "cpe:2.3:a:oracle:mysql_server:9.0.1_and_prior:*:*:*:*:*:*:*"
          ],
          "product": "MySQL Server",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "lessThanOrEqual": "8.0.39",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "8.4.2",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "9.0.1",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Vulnerability in the MySQL Server product of Oracle MySQL (component: Client programs).  Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and  9.0.1 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server. CVSS 3.1 Base Score 3.1 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server.",
              "lang": "en-US"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-10-15T19:52:45.633Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "Oracle Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2024.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2024-21231",
    "datePublished": "2024-10-15T19:52:45.633Z",
    "dateReserved": "2023-12-07T22:28:10.694Z",
    "dateUpdated": "2025-11-03T21:53:10.198Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-21236 (GCVE-0-2024-21236)

Vulnerability from cvelistv5 – Published: 2024-10-15 19:52 – Updated: 2025-11-03 21:53

Summary

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and 9.0.1 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

Severity

4.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-10-16 14:29 UTC

CWE

Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.
CWE-noinfo Not enough information

Assigner

oracle mitre root

References

2 references

URL	Tags
https://www.oracle.com/security-alerts/cpuoct2024.html	vendor-advisory
https://security.netapp.com/advisory/ntap-2024102…

Impacted products

1 product

Vendor	Product	Version
Oracle Corporation	MySQL Server	Affected: * , ≤ 8.0.39 (custom) Affected: * , ≤ 8.4.2 (custom) Affected: * , ≤ 9.0.1 (custom) cpe:2.3:a:oracle:mysql_server:8.0.39_and_prior:::::::* cpe:2.3:a:oracle:mysql_server:8.4.2_and_prior:::::::* cpe:2.3:a:oracle:mysql_server:9.0.1_and_prior:::::::*

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-21236",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-16T14:29:46.434475Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-25T15:49:38.118Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T21:53:16.093Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://security.netapp.com/advisory/ntap-20241025-0006/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:oracle:mysql_server:8.0.39_and_prior:*:*:*:*:*:*:*",
            "cpe:2.3:a:oracle:mysql_server:8.4.2_and_prior:*:*:*:*:*:*:*",
            "cpe:2.3:a:oracle:mysql_server:9.0.1_and_prior:*:*:*:*:*:*:*"
          ],
          "product": "MySQL Server",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "lessThanOrEqual": "8.0.39",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "8.4.2",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "9.0.1",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and  9.0.1 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.",
              "lang": "en-US"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-10-15T19:52:47.226Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "Oracle Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2024.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2024-21236",
    "datePublished": "2024-10-15T19:52:47.226Z",
    "dateReserved": "2023-12-07T22:28:10.698Z",
    "dateUpdated": "2025-11-03T21:53:16.093Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-21237 (GCVE-0-2024-21237)

Vulnerability from cvelistv5 – Published: 2024-10-15 19:52 – Updated: 2025-11-03 21:53

Summary

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Group Replication GCS). Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and 9.0.1 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server. CVSS 3.1 Base Score 2.2 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L).

Severity

2.2 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-10-16 14:28 UTC

CWE

Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server.
CWE-noinfo Not enough information

Assigner

oracle mitre root

References

2 references

URL	Tags
https://www.oracle.com/security-alerts/cpuoct2024.html	vendor-advisory
https://security.netapp.com/advisory/ntap-2024102…

Impacted products

1 product

Vendor	Product	Version
Oracle Corporation	MySQL Server	Affected: * , ≤ 8.0.39 (custom) Affected: * , ≤ 8.4.2 (custom) Affected: * , ≤ 9.0.1 (custom) cpe:2.3:a:oracle:mysql_server:8.0.39_and_prior:::::::* cpe:2.3:a:oracle:mysql_server:8.4.2_and_prior:::::::* cpe:2.3:a:oracle:mysql_server:9.0.1_and_prior:::::::*

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-21237",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-16T14:28:58.342571Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-25T16:01:38.517Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T21:53:17.543Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://security.netapp.com/advisory/ntap-20241025-0006/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:oracle:mysql_server:8.0.39_and_prior:*:*:*:*:*:*:*",
            "cpe:2.3:a:oracle:mysql_server:8.4.2_and_prior:*:*:*:*:*:*:*",
            "cpe:2.3:a:oracle:mysql_server:9.0.1_and_prior:*:*:*:*:*:*:*"
          ],
          "product": "MySQL Server",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "lessThanOrEqual": "8.0.39",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "8.4.2",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "9.0.1",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Group Replication GCS).  Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and  9.0.1 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server. CVSS 3.1 Base Score 2.2 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 2.2,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server.",
              "lang": "en-US"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-10-15T19:52:47.598Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "Oracle Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2024.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2024-21237",
    "datePublished": "2024-10-15T19:52:47.598Z",
    "dateReserved": "2023-12-07T22:28:10.698Z",
    "dateUpdated": "2025-11-03T21:53:17.543Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-21238 (GCVE-0-2024-21238)

Vulnerability from cvelistv5 – Published: 2024-10-15 19:52 – Updated: 2025-03-25 16:48

Summary

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Thread Pooling). Supported versions that are affected are 8.0.39 and prior, 8.4.1 and prior and 9.0.1 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H).

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-10-16 14:28 UTC

CWE

Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Cluster.
CWE-noinfo Not enough information

Assigner

oracle mitre root

References

2 references

URL	Tags
https://www.oracle.com/security-alerts/cpuoct2024.html	vendor-advisory
https://security.netapp.com/advisory/ntap-2024102…

Impacted products

2 products

Vendor	Product	Version
Oracle Corporation	MySQL Cluster	Affected: * , ≤ 7.5.35 (custom) Affected: * , ≤ 7.6.31 (custom) Affected: * , ≤ 8.0.39 (custom) Affected: * , ≤ 8.4.2 (custom) Affected: * , ≤ 9.0.1 (custom) cpe:2.3:a:oracle:mysql_cluster:7.5.35_and_prior:::::::* cpe:2.3:a:oracle:mysql_cluster:7.6.31_and_prior:::::::* cpe:2.3:a:oracle:mysql_cluster:8.0.39_and_prior:::::::* cpe:2.3:a:oracle:mysql_cluster:8.4.2_and_prior:::::::* cpe:2.3:a:oracle:mysql_cluster:9.0.1_and_prior:::::::*
Oracle Corporation	MySQL Server	Affected: * , ≤ 8.0.39 (custom) Affected: * , ≤ 8.4.1 (custom) Affected: * , ≤ 9.0.1 (custom) cpe:2.3:a:oracle:mysql_server:8.0.39_and_prior:::::::* cpe:2.3:a:oracle:mysql_server:8.4.1_and_prior:::::::* cpe:2.3:a:oracle:mysql_server:9.0.1_and_prior:::::::*

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-21238",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-16T14:28:18.316170Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-25T16:48:38.704Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-10-25T13:07:34.656Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://security.netapp.com/advisory/ntap-20241025-0009/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:oracle:mysql_cluster:7.5.35_and_prior:*:*:*:*:*:*:*",
            "cpe:2.3:a:oracle:mysql_cluster:7.6.31_and_prior:*:*:*:*:*:*:*",
            "cpe:2.3:a:oracle:mysql_cluster:8.0.39_and_prior:*:*:*:*:*:*:*",
            "cpe:2.3:a:oracle:mysql_cluster:8.4.2_and_prior:*:*:*:*:*:*:*",
            "cpe:2.3:a:oracle:mysql_cluster:9.0.1_and_prior:*:*:*:*:*:*:*"
          ],
          "product": "MySQL Cluster",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "lessThanOrEqual": "7.5.35",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "7.6.31",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "8.0.39",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "8.4.2",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "9.0.1",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:oracle:mysql_server:8.0.39_and_prior:*:*:*:*:*:*:*",
            "cpe:2.3:a:oracle:mysql_server:8.4.1_and_prior:*:*:*:*:*:*:*",
            "cpe:2.3:a:oracle:mysql_server:9.0.1_and_prior:*:*:*:*:*:*:*"
          ],
          "product": "MySQL Server",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "lessThanOrEqual": "8.0.39",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "8.4.1",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "9.0.1",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Thread Pooling).  Supported versions that are affected are 8.0.39 and prior, 8.4.1 and prior and  9.0.1 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 5.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Cluster.",
              "lang": "en-US"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-10-15T19:52:47.971Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "Oracle Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2024.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2024-21238",
    "datePublished": "2024-10-15T19:52:47.971Z",
    "dateReserved": "2023-12-07T22:28:10.698Z",
    "dateUpdated": "2025-03-25T16:48:38.704Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-21239 (GCVE-0-2024-21239)

Vulnerability from cvelistv5 – Published: 2024-10-15 19:52 – Updated: 2025-11-03 21:53

Summary

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and 9.0.1 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

Severity

4.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-10-16 14:26 UTC

CWE

Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.
CWE-noinfo Not enough information

Assigner

oracle mitre root

References

2 references

URL	Tags
https://www.oracle.com/security-alerts/cpuoct2024.html	vendor-advisory
https://security.netapp.com/advisory/ntap-2024102…

Impacted products

1 product

Vendor	Product	Version
Oracle Corporation	MySQL Server	Affected: * , ≤ 8.0.39 (custom) Affected: * , ≤ 8.4.2 (custom) Affected: * , ≤ 9.0.1 (custom) cpe:2.3:a:oracle:mysql_server:8.0.39_and_prior:::::::* cpe:2.3:a:oracle:mysql_server:8.4.2_and_prior:::::::* cpe:2.3:a:oracle:mysql_server:9.0.1_and_prior:::::::*

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-21239",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-16T14:26:58.371049Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-25T16:53:41.987Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T21:53:19.000Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://security.netapp.com/advisory/ntap-20241025-0006/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:oracle:mysql_server:8.0.39_and_prior:*:*:*:*:*:*:*",
            "cpe:2.3:a:oracle:mysql_server:8.4.2_and_prior:*:*:*:*:*:*:*",
            "cpe:2.3:a:oracle:mysql_server:9.0.1_and_prior:*:*:*:*:*:*:*"
          ],
          "product": "MySQL Server",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "lessThanOrEqual": "8.0.39",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "8.4.2",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "9.0.1",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and  9.0.1 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.",
              "lang": "en-US"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-10-15T19:52:48.332Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "Oracle Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2024.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2024-21239",
    "datePublished": "2024-10-15T19:52:48.332Z",
    "dateReserved": "2023-12-07T22:28:10.698Z",
    "dateUpdated": "2025-11-03T21:53:19.000Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-21241 (GCVE-0-2024-21241)

Vulnerability from cvelistv5 – Published: 2024-10-15 19:52 – Updated: 2025-11-03 21:53

Summary

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and 9.0.1 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

Severity

4.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-10-16 14:26 UTC

CWE

Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.
CWE-noinfo Not enough information

Assigner

oracle mitre root

References

2 references

URL	Tags
https://www.oracle.com/security-alerts/cpuoct2024.html	vendor-advisory
https://security.netapp.com/advisory/ntap-2024102…

Impacted products

1 product

Vendor	Product	Version
Oracle Corporation	MySQL Server	Affected: * , ≤ 8.0.39 (custom) Affected: * , ≤ 8.4.2 (custom) Affected: * , ≤ 9.0.1 (custom) cpe:2.3:a:oracle:mysql_server:8.0.39_and_prior:::::::* cpe:2.3:a:oracle:mysql_server:8.4.2_and_prior:::::::* cpe:2.3:a:oracle:mysql_server:9.0.1_and_prior:::::::*

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-21241",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-16T14:26:02.823378Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-25T15:50:44.842Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T21:53:20.461Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://security.netapp.com/advisory/ntap-20241025-0006/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:oracle:mysql_server:8.0.39_and_prior:*:*:*:*:*:*:*",
            "cpe:2.3:a:oracle:mysql_server:8.4.2_and_prior:*:*:*:*:*:*:*",
            "cpe:2.3:a:oracle:mysql_server:9.0.1_and_prior:*:*:*:*:*:*:*"
          ],
          "product": "MySQL Server",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "lessThanOrEqual": "8.0.39",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "8.4.2",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "9.0.1",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and  9.0.1 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.",
              "lang": "en-US"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-10-15T19:52:48.644Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "Oracle Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2024.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2024-21241",
    "datePublished": "2024-10-15T19:52:48.644Z",
    "dateReserved": "2023-12-07T22:28:10.699Z",
    "dateUpdated": "2025-11-03T21:53:20.461Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

ALSA-2025:1673

CVE-2024-21213 (GCVE-0-2024-21213)

CVE-2024-21218 (GCVE-0-2024-21218)

CVE-2024-21219 (GCVE-0-2024-21219)

CVE-2024-21230 (GCVE-0-2024-21230)

CVE-2024-21231 (GCVE-0-2024-21231)

CVE-2024-21236 (GCVE-0-2024-21236)

CVE-2024-21237 (GCVE-0-2024-21237)

CVE-2024-21238 (GCVE-0-2024-21238)

CVE-2024-21239 (GCVE-0-2024-21239)

CVE-2024-21241 (GCVE-0-2024-21241)

Tags

Sightings

Nomenclature

Related by attack behaviour