An update for mysql is now available for openEuler-22.03-LTS-SP1 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2024-2072 Final 1.0 1.0 2024-08-30 Initial 2024-08-30 2024-08-30 openEuler SA Tool V1.0 2024-08-30 mysql security update An update for mysql is now available for openEuler-22.03-LTS-SP1 The MySQL(TM) software delivers a very fast, multi-threaded, multi-user, and robust SQL (Structured Query Language) database server. MySQL Server is intended for mission-critical, heavy-load production systems as well as for embedding into mass-deployed software. MySQL is a trademark of Oracle and/or its affiliates Security Fix(es): The public API function BIO_new_NDEF is a helper function used for streaming ASN.1 data via a BIO. It is primarily used internally to OpenSSL to support the SMIME, CMS and PKCS7 streaming capabilities, but may also be called directly by end user applications. The function receives a BIO from the caller, prepends a new BIO_f_asn1 filter BIO onto the front of it to form a BIO chain, and then returns the new head of the BIO chain to the caller. Under certain conditions, for example if a CMS recipient public key is invalid, the new filter BIO is freed and the function returns a NULL result indicating a failure. However, in this case, the BIO chain is not properly cleaned up and the BIO passed by the caller still retains internal pointers to the previously freed filter BIO. If the caller then goes on to call BIO_pop() on the BIO then a use-after-free will occur. This will most likely result in a crash. This scenario occurs directly in the internal function B64_write_ASN1() which may cause BIO_new_NDEF() to be called and will subsequently call BIO_pop() on the BIO. This internal function is in turn called by the public API functions PEM_write_bio_ASN1_stream, PEM_write_bio_CMS_stream, PEM_write_bio_PKCS7_stream, SMIME_write_ASN1, SMIME_write_CMS and SMIME_write_PKCS7. Other public API functions that may be impacted by this include i2d_ASN1_bio_stream, BIO_new_CMS, BIO_new_PKCS7, i2d_CMS_bio_stream and i2d_PKCS7_bio_stream. The OpenSSL cms and smime command line applications are similarly affected. (CVE-2023-0215) This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake. When curl is asked to pass along the host name to the SOCKS5 proxy to allow that to resolve the address instead of it getting done by curl itself, the maximum length that host name can be is 255 bytes. If the host name is detected to be longer, curl switches to local name resolving and instead passes on the resolved address only. Due to this bug, the local variable that means "let the host resolve the name" could get the wrong value during a slow SOCKS5 handshake, and contrary to the intention, copy the too long host name to the target buffer instead of copying just the resolved address there. The target buffer being a heap based buffer, and the host name coming from the URL that curl has been told to operate with. (CVE-2023-38545) Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).(CVE-2024-21137) Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.36 and prior and 8.3.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).(CVE-2024-21159) An update for mysql is now available for openEuler-22.03-LTS-SP1. openEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. High mysql https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2072 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2023-0215 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2023-38545 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2024-21137 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2024-21159 https://nvd.nist.gov/vuln/detail/CVE-2023-0215 https://nvd.nist.gov/vuln/detail/CVE-2023-38545 https://nvd.nist.gov/vuln/detail/CVE-2024-21137 https://nvd.nist.gov/vuln/detail/CVE-2024-21159 openEuler-22.03-LTS-SP1 mysql-8.0.38-1.oe2203sp1.aarch64.rpm mysql-common-8.0.38-1.oe2203sp1.aarch64.rpm mysql-config-8.0.38-1.oe2203sp1.aarch64.rpm mysql-debuginfo-8.0.38-1.oe2203sp1.aarch64.rpm mysql-debugsource-8.0.38-1.oe2203sp1.aarch64.rpm mysql-devel-8.0.38-1.oe2203sp1.aarch64.rpm mysql-errmsg-8.0.38-1.oe2203sp1.aarch64.rpm mysql-help-8.0.38-1.oe2203sp1.aarch64.rpm mysql-libs-8.0.38-1.oe2203sp1.aarch64.rpm mysql-server-8.0.38-1.oe2203sp1.aarch64.rpm mysql-test-8.0.38-1.oe2203sp1.aarch64.rpm mysql-8.0.38-1.oe2203sp1.src.rpm mysql-8.0.38-1.oe2203sp1.x86_64.rpm mysql-common-8.0.38-1.oe2203sp1.x86_64.rpm mysql-config-8.0.38-1.oe2203sp1.x86_64.rpm mysql-debuginfo-8.0.38-1.oe2203sp1.x86_64.rpm mysql-debugsource-8.0.38-1.oe2203sp1.x86_64.rpm mysql-devel-8.0.38-1.oe2203sp1.x86_64.rpm mysql-errmsg-8.0.38-1.oe2203sp1.x86_64.rpm mysql-help-8.0.38-1.oe2203sp1.x86_64.rpm mysql-libs-8.0.38-1.oe2203sp1.x86_64.rpm mysql-server-8.0.38-1.oe2203sp1.x86_64.rpm mysql-test-8.0.38-1.oe2203sp1.x86_64.rpm The public API function BIO_new_NDEF is a helper function used for streamingASN.1 data via a BIO. It is primarily used internally to OpenSSL to support theSMIME, CMS and PKCS7 streaming capabilities, but may also be called directly byend user applications.The function receives a BIO from the caller, prepends a new BIO_f_asn1 filterBIO onto the front of it to form a BIO chain, and then returns the new head ofthe BIO chain to the caller. Under certain conditions, for example if a CMSrecipient public key is invalid, the new filter BIO is freed and the functionreturns a NULL result indicating a failure. However, in this case, the BIO chainis not properly cleaned up and the BIO passed by the caller still retainsinternal pointers to the previously freed filter BIO. If the caller then goes onto call BIO_pop() on the BIO then a use-after-free will occur. This will mostlikely result in a crash.This scenario occurs directly in the internal function B64_write_ASN1() whichmay cause BIO_new_NDEF() to be called and will subsequently call BIO_pop() onthe BIO. This internal function is in turn called by the public API functionsPEM_write_bio_ASN1_stream, PEM_write_bio_CMS_stream, PEM_write_bio_PKCS7_stream,SMIME_write_ASN1, SMIME_write_CMS and SMIME_write_PKCS7.Other public API functions that may be impacted by this includei2d_ASN1_bio_stream, BIO_new_CMS, BIO_new_PKCS7, i2d_CMS_bio_stream andi2d_PKCS7_bio_stream.The OpenSSL cms and smime command line applications are similarly affected. 2024-08-30 CVE-2023-0215 openEuler-22.03-LTS-SP1 High 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H mysql security update 2024-08-30 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2072 This flaw makes curl overflow a heap based buffer in the SOCKS5 proxyhandshake.When curl is asked to pass along the host name to the SOCKS5 proxy to allowthat to resolve the address instead of it getting done by curl itself, themaximum length that host name can be is 255 bytes.If the host name is detected to be longer, curl switches to local nameresolving and instead passes on the resolved address only. Due to this bug,the local variable that means let the host resolve the name could get thewrong value during a slow SOCKS5 handshake, and contrary to the intention,copy the too long host name to the target buffer instead of copying just theresolved address there.The target buffer being a heap based buffer, and the host name coming from theURL that curl has been told to operate with. 2024-08-30 CVE-2023-38545 openEuler-22.03-LTS-SP1 High 7.5 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H mysql security update 2024-08-30 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2072 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). 2024-08-30 CVE-2024-21137 openEuler-22.03-LTS-SP1 Medium 4.9 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H mysql security update 2024-08-30 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2072 Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.36 and prior and 8.3.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). 2024-08-30 CVE-2024-21159 openEuler-22.03-LTS-SP1 Medium 4.9 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H mysql security update 2024-08-30 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2072