Bug 2016096 (CVE-2021-35583)

Summary: CVE-2021-35583 mysql: Server: Windows unspecified vulnerability (CPU Oct 2021)
Product: [Other] Security Response Reporter: Guilherme de Almeida Suckevicz <gsuckevi>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED NOTABUG QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: damien.ciabrini, databases-maint, dbecker, dciabrin, hhorak, jjoyce, jorton, jschluet, lhh, ljavorsk, lpeer, mbayer, mburns, mkocka, mmuzila, mschorm, sclewis, slinaber, SpikeFedora
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Fixed In Version: mysql 8.0.26 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2021-10-27 02:08:04 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On:    
Bug Blocks: 2016154    

Description Guilherme de Almeida Suckevicz 2021-10-20 18:39:11 UTC
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Windows). Supported versions that are affected are 8.0.25 and prior. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.

External References:


Comment 1 Guilherme de Almeida Suckevicz 2021-10-20 18:51:19 UTC
Created community-mysql tracking bugs for this issue:

Affects: fedora-all [bug 2016141]

Created mysql:8.0/community-mysql tracking bugs for this issue:

Affects: fedora-all [bug 2016142]

Comment 2 Tomas Hoger 2021-10-26 20:48:28 UTC
The affected component as listed in the upstream advisory - Server: Windows - indicates that this issue affected MySQL versions for Windows platform, and hence would not affect Linux versions of MySQL.

Comment 3 Tomas Hoger 2021-10-26 20:50:53 UTC
Even though this issue was only listed in the Oracle Critical Patch Update Advisory - October 2021, it's listed as fixed in version 8.0.26, which was released in July 2021.  The MySQL packages as shipped in Red Hat Enterprise Linux 8 and Red Hat Software Collections were already updated to that version via the following errata:


Comment 4 Product Security DevOps Team 2021-10-27 02:08:04 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):