Bug 2016096 (CVE-2021-35583)

Summary:	CVE-2021-35583 mysql: Server: Windows unspecified vulnerability (CPU Oct 2021)
Product:	[Other] Security Response	Reporter:	Guilherme de Almeida Suckevicz <gsuckevi>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	damien.ciabrini, databases-maint, dbecker, dciabrin, hhorak, jjoyce, jorton, jschluet, lhh, ljavorsk, lpeer, mbayer, mburns, mkocka, mmuzila, mschorm, sclewis, slinaber, SpikeFedora
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	mysql 8.0.26	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-10-27 02:08:04 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2016154

Description Guilherme de Almeida Suckevicz 2021-10-20 18:39:11 UTC

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Windows). Supported versions that are affected are 8.0.25 and prior. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.

External References:

http://www.oracle.com/security-alerts/cpuoct2021.html#AppendixMSQL

Comment 1 Guilherme de Almeida Suckevicz 2021-10-20 18:51:19 UTC

Created community-mysql tracking bugs for this issue:

Affects: fedora-all [bug 2016141]


Created mysql:8.0/community-mysql tracking bugs for this issue:

Affects: fedora-all [bug 2016142]

Comment 2 Tomas Hoger 2021-10-26 20:48:28 UTC

The affected component as listed in the upstream advisory - Server: Windows - indicates that this issue affected MySQL versions for Windows platform, and hence would not affect Linux versions of MySQL.

Comment 3 Tomas Hoger 2021-10-26 20:50:53 UTC

Even though this issue was only listed in the Oracle Critical Patch Update Advisory - October 2021, it's listed as fixed in version 8.0.26, which was released in July 2021.  The MySQL packages as shipped in Red Hat Enterprise Linux 8 and Red Hat Software Collections were already updated to that version via the following errata:

https://access.redhat.com/errata/RHSA-2020:3757
https://access.redhat.com/errata/RHSA-2021:3811

Comment 4 Product Security DevOps Team 2021-10-27 02:08:04 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-35583