From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id B12E4158064 for ; Wed, 8 May 2024 08:41:49 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 555F22BC04E; Wed, 8 May 2024 08:41:24 +0000 (UTC) Received: from smtp.gentoo.org (mail.gentoo.org [IPv6:2001:470:ea4a:1:5054:ff:fec7:86e4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id ADAF7E2AA5 for ; Wed, 8 May 2024 08:41:00 +0000 (UTC) Received: from glsamakerdev.dev.gentoo.org (unknown [140.211.166.165]) by smtp.gentoo.org (Postfix) with ESMTP id 1248C335C31 for ; Wed, 8 May 2024 08:41:00 +0000 (UTC) Received: from [172.18.0.3] (unknown [172.18.0.3]) by glsamakerdev.dev.gentoo.org (Postfix) with ESMTP id 027F3B3A62 for ; Wed, 8 May 2024 08:41:00 +0000 (UTC) Subject: [gentoo-announce] [ GLSA 202405-25 ] MariaDB: Multiple Vulnerabilities Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-announce@lists.gentoo.org X-Auto-Response-Suppress: DR, RN, NRN, OOF, AutoReply MIME-Version: 1.0 Content-Type: multipart/signed; protocol="application/pgp-signature"; micalg="pgp-sha512"; boundary="===============1198816729744162092==" From: glsamaker@gentoo.org To: gentoo-announce@lists.gentoo.org Reply-To: security@gentoo.org Date: Wed, 08 May 2024 08:40:59 -0000 Message-ID: <171515766000.8.14999553345532471691@987c7955d8b1> X-Archives-Salt: 828487f4-791d-408d-8ee6-e3727fdc8fa6 X-Archives-Hash: 69fafe99422362bbbfdc1f364c1a06d3 --===============1198816729744162092== Content-Type: text/plain; charset="utf-8" - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 202405-25 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: MariaDB: Multiple Vulnerabilities Date: May 08, 2024 Bugs: #699874, #822759, #832490, #838244, #847526, #856484, #891781 ID: 202405-25 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== Multiple vulnerabilities have been discovered in MariaDB, the worst fo which can lead to arbitrary execution of code. Background ========== MariaDB is an enhanced, drop-in replacement for MySQL. Affected packages ================= Package Vulnerable Unaffected -------------- --------------- ---------------- dev-db/mariadb < 10.11.3:10.11 >= 10.11.3:10.11 < 10.11.3:10.6 >= 10.6.13:10.6 < 10.11.3 >= 10.6.13 Description =========== Multiple vulnerabilities have been discovered in MariaDB. Please review the CVE identifiers referenced below for details. Impact ====== Please review the referenced CVE identifiers for details. Workaround ========== There is no known workaround at this time. Resolution ========== All MariaDB 10.6 users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=dev-db/mariadb-10.11.3:10.6" All MariaDB 10.11 users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=dev-db/mariadb-10.11.3:10.11" References ========== [ 1 ] CVE-2019-2938 https://nvd.nist.gov/vuln/detail/CVE-2019-2938 [ 2 ] CVE-2019-2974 https://nvd.nist.gov/vuln/detail/CVE-2019-2974 [ 3 ] CVE-2021-46661 https://nvd.nist.gov/vuln/detail/CVE-2021-46661 [ 4 ] CVE-2021-46662 https://nvd.nist.gov/vuln/detail/CVE-2021-46662 [ 5 ] CVE-2021-46663 https://nvd.nist.gov/vuln/detail/CVE-2021-46663 [ 6 ] CVE-2021-46664 https://nvd.nist.gov/vuln/detail/CVE-2021-46664 [ 7 ] CVE-2021-46665 https://nvd.nist.gov/vuln/detail/CVE-2021-46665 [ 8 ] CVE-2021-46666 https://nvd.nist.gov/vuln/detail/CVE-2021-46666 [ 9 ] CVE-2021-46667 https://nvd.nist.gov/vuln/detail/CVE-2021-46667 [ 10 ] CVE-2021-46668 https://nvd.nist.gov/vuln/detail/CVE-2021-46668 [ 11 ] CVE-2021-46669 https://nvd.nist.gov/vuln/detail/CVE-2021-46669 [ 12 ] CVE-2022-24048 https://nvd.nist.gov/vuln/detail/CVE-2022-24048 [ 13 ] CVE-2022-24050 https://nvd.nist.gov/vuln/detail/CVE-2022-24050 [ 14 ] CVE-2022-24051 https://nvd.nist.gov/vuln/detail/CVE-2022-24051 [ 15 ] CVE-2022-24052 https://nvd.nist.gov/vuln/detail/CVE-2022-24052 [ 16 ] CVE-2022-27376 https://nvd.nist.gov/vuln/detail/CVE-2022-27376 [ 17 ] CVE-2022-27377 https://nvd.nist.gov/vuln/detail/CVE-2022-27377 [ 18 ] CVE-2022-27378 https://nvd.nist.gov/vuln/detail/CVE-2022-27378 [ 19 ] CVE-2022-27379 https://nvd.nist.gov/vuln/detail/CVE-2022-27379 [ 20 ] CVE-2022-27380 https://nvd.nist.gov/vuln/detail/CVE-2022-27380 [ 21 ] CVE-2022-27381 https://nvd.nist.gov/vuln/detail/CVE-2022-27381 [ 22 ] CVE-2022-27382 https://nvd.nist.gov/vuln/detail/CVE-2022-27382 [ 23 ] CVE-2022-27383 https://nvd.nist.gov/vuln/detail/CVE-2022-27383 [ 24 ] CVE-2022-27384 https://nvd.nist.gov/vuln/detail/CVE-2022-27384 [ 25 ] CVE-2022-27385 https://nvd.nist.gov/vuln/detail/CVE-2022-27385 [ 26 ] CVE-2022-27386 https://nvd.nist.gov/vuln/detail/CVE-2022-27386 [ 27 ] CVE-2022-27444 https://nvd.nist.gov/vuln/detail/CVE-2022-27444 [ 28 ] CVE-2022-27445 https://nvd.nist.gov/vuln/detail/CVE-2022-27445 [ 29 ] CVE-2022-27446 https://nvd.nist.gov/vuln/detail/CVE-2022-27446 [ 30 ] CVE-2022-27447 https://nvd.nist.gov/vuln/detail/CVE-2022-27447 [ 31 ] CVE-2022-27448 https://nvd.nist.gov/vuln/detail/CVE-2022-27448 [ 32 ] CVE-2022-27449 https://nvd.nist.gov/vuln/detail/CVE-2022-27449 [ 33 ] CVE-2022-27451 https://nvd.nist.gov/vuln/detail/CVE-2022-27451 [ 34 ] CVE-2022-27452 https://nvd.nist.gov/vuln/detail/CVE-2022-27452 [ 35 ] CVE-2022-27455 https://nvd.nist.gov/vuln/detail/CVE-2022-27455 [ 36 ] CVE-2022-27456 https://nvd.nist.gov/vuln/detail/CVE-2022-27456 [ 37 ] CVE-2022-27457 https://nvd.nist.gov/vuln/detail/CVE-2022-27457 [ 38 ] CVE-2022-27458 https://nvd.nist.gov/vuln/detail/CVE-2022-27458 [ 39 ] CVE-2022-31621 https://nvd.nist.gov/vuln/detail/CVE-2022-31621 [ 40 ] CVE-2022-31622 https://nvd.nist.gov/vuln/detail/CVE-2022-31622 [ 41 ] CVE-2022-31623 https://nvd.nist.gov/vuln/detail/CVE-2022-31623 [ 42 ] CVE-2022-31624 https://nvd.nist.gov/vuln/detail/CVE-2022-31624 [ 43 ] CVE-2022-32081 https://nvd.nist.gov/vuln/detail/CVE-2022-32081 [ 44 ] CVE-2022-32082 https://nvd.nist.gov/vuln/detail/CVE-2022-32082 [ 45 ] CVE-2022-32083 https://nvd.nist.gov/vuln/detail/CVE-2022-32083 [ 46 ] CVE-2022-32084 https://nvd.nist.gov/vuln/detail/CVE-2022-32084 [ 47 ] CVE-2022-32085 https://nvd.nist.gov/vuln/detail/CVE-2022-32085 [ 48 ] CVE-2022-32086 https://nvd.nist.gov/vuln/detail/CVE-2022-32086 [ 49 ] CVE-2022-32088 https://nvd.nist.gov/vuln/detail/CVE-2022-32088 [ 50 ] CVE-2022-32089 https://nvd.nist.gov/vuln/detail/CVE-2022-32089 [ 51 ] CVE-2022-32091 https://nvd.nist.gov/vuln/detail/CVE-2022-32091 [ 52 ] CVE-2022-38791 https://nvd.nist.gov/vuln/detail/CVE-2022-38791 [ 53 ] CVE-2022-47015 https://nvd.nist.gov/vuln/detail/CVE-2022-47015 [ 54 ] CVE-2023-5157 https://nvd.nist.gov/vuln/detail/CVE-2023-5157 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/202405-25 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2024 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. https://creativecommons.org/licenses/by-sa/2.5 --===============1198816729744162092== Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEpqTA6ABLMxh/aChGFMQkOaVy+9kFAmY7OpsACgkQFMQkOaVy +9nENg/9FQV8SNXuIKv8F+DN+CdBIvQ76MlkzXOYcWedQFF8hYcC7gKSnGgFXws0 KTg82DazpW55rYMYAlhLMxUJnerZSl8vB1t59ibDz6QbxPGgig7/fVGUGPJw6O3v RiiZAhvYWVStXm1tmnnRZfNND0efu8flAB3y0fCHnFhKW6RbrIAc/DFsH0bDDar6 WYuLG+ydeGias5N+C353rZV43TUwmvVjk5LSKAi5/7PloW/cbk+gOvy63qxFdLSq jGynX4LwqTBZ1J+Xk0UkTTNTIiI0aRzb2X4L8wz3OGixYC1T+n+iozfcNFokBfW2 warA6C/9ijajk0V+EY35okN5U2m2Uy1QGzACvtSwsXATCqzsWrext9YDJb0ncIMH Un38Fa9ye6mlJsK1Q4e0LS4JFu9Z1YqragW3tIalSqbyyX4T9L7DoFJnKhU+E3Rb wbrAwDdtN4Uf0lXq7uGQBCyopFarUv+vhsAPzWOACuYAocy9lf+YKeJHmz+gmmOb gswaUrcRZLHN3O6Ca+i+bIAtq85VpxKMNqjcy5ss9xhh6QLRyb8hi/ES2HeDOOWh fWLPNhNelwdmXVUCHrkyE364++kbuP1W+EG1LTRDe8eP0fEK0IoBL7AgE+w34KyH vfGW4cPW5mAaGztEgD26qA4fOVq9XuJDGwOKgaFH95Z6BVbAZF0= =bHuL -----END PGP SIGNATURE----- --===============1198816729744162092==--