Bug 2231877

Summary:	CVE-2022-4899 CVE-2023-22005 CVE-2023-22008 CVE-2023-22033 CVE-2023-22038 CVE-2023-22046 CVE-2023-22048 CVE-2023-22053 CVE-2023-22054 CVE-2023-22056 CVE-2023-22057 CVE-2023-22058 mysql:8.0/community-mysql: various flaws [fedora-all]
Product:	[Fedora] Fedora	Reporter:	Mauro Matteo Cascella <mcascell>
Component:	community-mysql	Assignee:	Michal Schorm <mschorm>
Status:	NEW ---	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	38	CC:	hhorak, ljavorsk, mmuzila, mschorm
Target Milestone:	---	Keywords:	Security, SecurityTracking
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	No Doc Update
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2179864, 2224211, 2224213, 2224214, 2224215, 2224216, 2224217, 2224218, 2224219, 2224220, 2224221, 2224222

Description Mauro Matteo Cascella 2023-08-14 14:06:12 UTC

More information about these security flaws is available in the following bugs:

http://bugzilla.redhat.com/show_bug.cgi?id=2224216
http://bugzilla.redhat.com/show_bug.cgi?id=2224219
http://bugzilla.redhat.com/show_bug.cgi?id=2224221
http://bugzilla.redhat.com/show_bug.cgi?id=2224222
http://bugzilla.redhat.com/show_bug.cgi?id=2224217
http://bugzilla.redhat.com/show_bug.cgi?id=2224220
http://bugzilla.redhat.com/show_bug.cgi?id=2224213
http://bugzilla.redhat.com/show_bug.cgi?id=2224211
http://bugzilla.redhat.com/show_bug.cgi?id=2224218
http://bugzilla.redhat.com/show_bug.cgi?id=2224214
http://bugzilla.redhat.com/show_bug.cgi?id=2224215

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

Comment 1 Mauro Matteo Cascella 2023-08-14 14:06:14 UTC

Use the following template to for the 'fedpkg update' request to submit an
update for this issue as it contains the top-level parent bug(s) as well as
this tracking bug.  This will ensure that all associated bugs get updated
when new packages are pushed to stable.

=====

# bugfix, security, enhancement, newpackage (required)
type=security

# low, medium, high, urgent (required)
severity=medium

# testing, stable
request=testing

# Bug numbers: 1234,9876
bugs=2224211,2224213,2224214,2224215,2224216,2224217,2224218,2224219,2224220,2224221,2224222,2231877

# Description of your update
notes=Security fix for [PUT CVEs HERE]

# Enable request automation based on the stable/unstable karma thresholds
autokarma=True
stable_karma=3
unstable_karma=-3

# Automatically close bugs when this marked as stable
close_bugs=True

# Suggest that users restart after update
suggest_reboot=False

======

Additionally, you may opt to use the bodhi web interface to submit updates:

https://bodhi.fedoraproject.org/updates/new

Comment 2 Mauro Matteo Cascella 2023-08-14 14:17:15 UTC

These CVEs were fixed upstream in MySQL 8.0.34 (Oracle CPU Jul 2023).

https://www.oracle.com/security-alerts/cpujul2023.html#AppendixMSQL