CVE-2022-47015

MariaDB Server before 10.3.34 thru 10.9.3 is vulnerable to Denial of Service. It is possible for function spider_db_mbase::print_warnings to dereference a null pointer.

MariaDB turns data into structured information in a wide array of applications, ranging from banking to websites. It is an enhanced, drop-in replacement for MySQL. MariaDB is used because it is fast, scalable and robust, with a rich ecosystem of storage engines, plugins and many other tools make it very versatile for a wide variety of use cases.

Security Fix(es):

The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in compressed form or explicit elliptic curve parameters with a base point encoded in compressed form. It is possible to trigger the infinite loop by crafting a certificate that has invalid explicit curve parameters. Since certificate parsing happens prior to verification of the certificate signature, any process that parses an externally supplied certificate may thus be subject to a denial of service attack. The infinite loop can also be reached when parsing crafted private keys as they can contain explicit elliptic curve parameters. Thus vulnerable situations include: - TLS clients consuming server certificates - TLS servers consuming client certificates - Hosting providers taking certificates or private keys from customers - Certificate authorities parsing certification requests from subscribers - Anything else which parses ASN.1 elliptic curve parameters Also any other applications that use the BN_mod_sqrt() where the attacker can control the parameter values are vulnerable to this DoS issue. In the OpenSSL 1.0.2 version the public key is not parsed during initial parsing of the certificate which makes it slightly harder to trigger the infinite loop. However any operation which requires the public key from the certificate will trigger the infinite loop. In particular the attacker can use a self-signed certificate to trigger the loop during verification of the certificate signature. This issue affects OpenSSL versions 1.0.2, 1.1.1 and 3.0. It was addressed in the releases of 1.1.1n and 3.0.2 on the 15th March 2022. Fixed in OpenSSL 3.0.2 (Affected 3.0.0,3.0.1). Fixed in OpenSSL 1.1.1n (Affected 1.1.1-1.1.1m). Fixed in OpenSSL 1.0.2zd (Affected 1.0.2-1.0.2zc).(CVE-2022-0778)

MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component Item_func_in::cleanup/Item::cleanup_processor.(CVE-2022-32085)

MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component Item_args::walk_args.(CVE-2022-32087)

MariaDB v10.7 was discovered to contain an use-after-poison in in __interceptor_memset at /libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc.(CVE-2022-32091)

MariaDB Server before 10.3.34 thru 10.9.3 is vulnerable to Denial of Service. It is possible for function spider_db_mbase::print_warnings to dereference a null pointer.(CVE-2022-47015)

MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL.

The following packages have been upgraded to a later upstream version: mariadb (10.3). (BZ#2223572, BZ#2223574, BZ#2223962, BZ#2223965)

Security Fix(es):

• mariadb: segmentation fault via the component sub_select (CVE-2022-32084)

• mariadb: server crash in JOIN_CACHE::free or in copy_fields (CVE-2022-32091)

• mariadb: compress_write() fails to release mutex on failure (CVE-2022-38791)

• mariadb: NULL pointer dereference in spider_db_mbase::print_warnings() (CVE-2022-47015)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• [MariaDB 10.3.32] socat: E Failed to set SNI host "" (SST failure) (BZ#2223961)

MariaDB Server before 10.3.34 thru 10.9.3 is vulnerable to Denial of Service. It is possible for function spider_db_mbase::print_warnings to dereference a null pointer.

MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL.

The following packages have been upgraded to a later upstream version: mariadb (10.3). (BZ#2223572, BZ#2223574, BZ#2223962, BZ#2223965)

Security Fix(es):

• mariadb: segmentation fault via the component sub_select (CVE-2022-32084)
• mariadb: server crash in JOIN_CACHE::free or in copy_fields (CVE-2022-32091)
• mariadb: compress_write() fails to release mutex on failure (CVE-2022-38791)
• mariadb: NULL pointer dereference in spider_db_mbase::print_warnings() (CVE-2022-47015)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• [MariaDB 10.3.32] socat: E Failed to set SNI host "" (SST failure) (BZ#2223961)

MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL.

The following packages have been upgraded to a later upstream version: galera (26.4.14), mariadb (10.5.22).

Security Fix(es):

• mariadb: node crashes with Transport endpoint is not connected mysqld got signal 6 (CVE-2023-5157)
• mariadb: use-after-poison in prepare_inplace_add_virtual in handler0alter.cc (CVE-2022-32081)
• mariadb: assertion failure at table->get_ref_count() == 0 in dict0dict.cc (CVE-2022-32082)
• mariadb: segmentation fault via the component sub_select (CVE-2022-32084)
• mariadb: server crash in st_select_lex_unit::exclude_level (CVE-2022-32089)
• mariadb: server crash in JOIN_CACHE::free or in copy_fields (CVE-2022-32091)
• mariadb: compress_write() fails to release mutex on failure (CVE-2022-38791)
• mariadb: NULL pointer dereference in spider_db_mbase::print_warnings() (CVE-2022-47015)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL.

The following packages have been upgraded to a later upstream version: galera (26.4.14), mariadb (10.5.22).

Security Fix(es):

• mariadb: node crashes with Transport endpoint is not connected mysqld got signal 6 (CVE-2023-5157)
• mariadb: use-after-poison in prepare_inplace_add_virtual in handler0alter.cc (CVE-2022-32081)
• mariadb: assertion failure at table->get_ref_count() == 0 in dict0dict.cc (CVE-2022-32082)
• mariadb: segmentation fault via the component sub_select (CVE-2022-32084)
• mariadb: server crash in st_select_lex_unit::exclude_level (CVE-2022-32089)
• mariadb: server crash in JOIN_CACHE::free or in copy_fields (CVE-2022-32091)
• mariadb: compress_write() fails to release mutex on failure (CVE-2022-38791)
• mariadb: NULL pointer dereference in spider_db_mbase::print_warnings() (CVE-2022-47015)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

MariaDB Server before 10.3.34 thru 10.9.3 is vulnerable to Denial of Service. It is possible for function spider_db_mbase::print_warnings to dereference a null pointer.

MariaDB Server before 10.3.34 thru 10.9.3 is vulnerable to Denial of Service. It is possible for function spider_db_mbase::print_warnings to dereference a null pointer.

MariaDB Server before 10.3.34 thru 10.9.3 is vulnerable to Denial of Service. It is possible for function spider_db_mbase::print_warnings to dereference a null pointer.

MariaDB Server before 10.3.34 thru 10.9.3 is vulnerable to Denial of Service. It is possible for function spider_db_mbase::print_warnings to dereference a null pointer.

It is possible for function spider_db_mbase::print_warnings to dereference a null pointer. (CVE-2022-47015)

These are all security issues fixed in the libmariadbd-devel-10.11.3-1.1 package on the GA media of openSUSE Tumbleweed.

MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL.

The following packages have been upgraded to a later upstream version: galera (26.4.14), mariadb (10.5.22).

Security Fix(es):

• mariadb: node crashes with Transport endpoint is not connected mysqld got signal 6 (CVE-2023-5157)

• mariadb: use-after-poison in prepare_inplace_add_virtual in handler0alter.cc (CVE-2022-32081)

• mariadb: assertion failure at table->get_ref_count() == 0 in dict0dict.cc (CVE-2022-32082)

• mariadb: segmentation fault via the component sub_select (CVE-2022-32084)

• mariadb: server crash in st_select_lex_unit::exclude_level (CVE-2022-32089)

• mariadb: server crash in JOIN_CACHE::free or in copy_fields (CVE-2022-32091)

• mariadb: compress_write() fails to release mutex on failure (CVE-2022-38791)

• mariadb: NULL pointer dereference in spider_db_mbase::print_warnings() (CVE-2022-47015)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This update for mariadb104 fixes the following issues:

• Implement version 10.4 of MariaDB (jsc#PED-2455):
  • It is possible to use more than one authentication plugin for each user account.
  • The root user account is being created with the ability to use two authentication plugins.
  • All user accounts, passwords, and global privileges are now stored in the mysql.global_priv table.
  • Is being supported for User Password Expiry, which is not active by default.
  • Faster privilege checks for MariaDB setups with many user accounts or many database grants.
• Update mysql-systemd-helper to be aware of custom group (bsc#1200105)
• MariaDB is now support lz4 compression for 'INNODB'. (bsc#1186031)
• Add 'mysql-user.conf' file to enable systemd generating mysql user in containers. (bsc#1173028)
• Fixes an issue when MariaDB is ignoring the value of the parameter 'open_files_limit' in the global variables. (bsc#1180014)

This update for mariadb104 fixes the following issues:

• Implement version 10.4 of MariaDB (jsc#PED-2455):
  • It is possible to use more than one authentication plugin for each user account.
  • The root user account is being created with the ability to use two authentication plugins.
  • All user accounts, passwords, and global privileges are now stored in the mysql.global_priv table.
  • Is being supported for User Password Expiry, which is not active by default.
  • Faster privilege checks for MariaDB setups with many user accounts or many database grants.
• Update mysql-systemd-helper to be aware of custom group (bsc#1200105)
• MariaDB is now support lz4 compression for 'INNODB'. (bsc#1186031)
• Add 'mysql-user.conf' file to enable systemd generating mysql user in containers. (bsc#1173028)
• Fixes an issue when MariaDB is ignoring the value of the parameter 'open_files_limit' in the global variables. (bsc#1180014)

This update for mariadb fixes the following issues:

Updated to version 10.5.20:

• CVE-2022-47015: Fixed a denial of service that could be triggered by a crafted SQL query (bsc#1207404).

This update for mariadb fixes the following issues:

Updated to version 10.5.20:

• CVE-2022-47015: Fixed a denial of service that could be triggered by a crafted SQL query (bsc#1207404).

This update for mariadb fixes the following issues:

Updated to version 10.6.13:

• CVE-2022-47015: Fixed a denial of service that could be triggered by a crafted SQL query (bsc#1207404).

This update for mariadb fixes the following issues:

This update provides MariaDB 10.5.21.

See release notes at https://mariadb.com/kb/en/mariadb-10-5-21-release-notes/ and changelog at https://mariadb.com/kb/en/mariadb-10-5-21-changelog/ .

Security issues fixed:

• CVE-2022-47015: Fixed a NULL pointer dereference in spider_db_mbase:print_warnings (bsc#1207404).

This update for mariadb fixes the following issues:

Updated to version 10.4.31:

• CVE-2022-47015: Fixed a denial of service that could be triggered by a crafted SQL query (bsc#1207404).

Several security issues were discovered in MariaDB and this update includes new upstream MariaDB versions to fix these issues.

MariaDB has been updated to 10.3.39 in Ubuntu 20.04 LTS, 10.6.16 in Ubuntu 22.04 LTS and 10.11.6 in Ubuntu 23.10.

CVE-2022-47015 only affected the MariaDB packages in Ubuntu 20.04 LTS and Ubuntu 22.04 LTS.

In addition to security fixes, the updated packages contain bug fixes, new features, and possibly incompatible changes.