CVE-2024-21159
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported...
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.36 and prior and 8.3.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.36 and prior and 8.3.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
- Record
CVE-2024-21159- CVSS 3.1
- 4.9 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-285
- Updated
- 2026-11-02
EUVDEUVD-2024-18873
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.36 and prior and 8.3.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
- Record
EUVD-2024-18873- CVSS 3.1
- 4.9 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-qj89-gqxq-9f84
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported...
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.36 and prior and 8.3.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
- Record
GHSA-qj89-gqxq-9f84- CVSS 3.1
- 4.9 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-285
- Updated
- 2026-11-02
NVD
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.36 and prior and 8.3.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
- Record
CVE-2024-21159- CVSS 3.1
- 4.9 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-285
- Updated
- 2026-11-02
OSV
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.36 and prior and 8.3.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
- Record
CVE-2024-21159- CVSS 3.1
- 4.9 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2024-2070
mysql security update
The MySQL(TM) software delivers a very fast, multi-threaded, multi-user, and robust SQL (Structured Query Language) database server. MySQL Server is intended for mission-critical, heavy-load production systems as well as for embedding into mass-deployed software. MySQL is a trademark of Oracle and/or its affiliates
Security Fix(es):
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).(CVE-2024-21137)
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.36 and prior and 8.3.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).(CVE-2024-21159)
- Record
OESA-2024-2070- CVSS 3.1
- 4.9 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 7 moreShow less
OSVOESA-2024-2071
mysql security update
The MySQL(TM) software delivers a very fast, multi-threaded, multi-user, and robust SQL (Structured Query Language) database server. MySQL Server is intended for mission-critical, heavy-load production systems as well as for embedding into mass-deployed software. MySQL is a trademark of Oracle and/or its affiliates
Security Fix(es):
Security Fix(es):
Nullptr dereference when a null char is present in a proto symbol. The symbol is parsed incorrectly, leading to an unchecked call into the proto file's name during generation of the resulting error message. Since the symbol is incorrectly parsed, the file is nullptr. We recommend upgrading to version 3.15.0 or greater.(CVE-2021-22570)
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.28 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).(CVE-2022-21412)
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.28 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).(CVE-2022-21413)
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.28 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).(CVE-2022-21414)
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.37 and prior and 8.0.28 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).(CVE-2022-21417)
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.28 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.1 Base Score 5.0 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H).(CVE-2022-21418)
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.28 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized…
- Record
OESA-2024-2071- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2024-2072
mysql security update
The MySQL(TM) software delivers a very fast, multi-threaded, multi-user, and robust SQL (Structured Query Language) database server. MySQL Server is intended for mission-critical, heavy-load production systems as well as for embedding into mass-deployed software. MySQL is a trademark of Oracle and/or its affiliates
Security Fix(es):
The public API function BIO_new_NDEF is a helper function used for streaming ASN.1 data via a BIO. It is primarily used internally to OpenSSL to support the SMIME, CMS and PKCS7 streaming capabilities, but may also be called directly by end user applications.
The function receives a BIO from the caller, prepends a new BIO_f_asn1 filter BIO onto the front of it to form a BIO chain, and then returns the new head of the BIO chain to the caller. Under certain conditions, for example if a CMS recipient public key is invalid, the new filter BIO is freed and the function returns a NULL result indicating a failure. However, in this case, the BIO chain is not properly cleaned up and the BIO passed by the caller still retains internal pointers to the previously freed filter BIO. If the caller then goes on to call BIO_pop() on the BIO then a use-after-free will occur. This will most likely result in a crash.
This scenario occurs directly in the internal function B64_write_ASN1() which may cause BIO_new_NDEF() to be called and will subsequently call BIO_pop() on the BIO. This internal function is in turn called by the public API functions PEM_write_bio_ASN1_stream, PEM_write_bio_CMS_stream, PEM_write_bio_PKCS7_stream, SMIME_write_ASN1, SMIME_write_CMS and SMIME_write_PKCS7.
Other public API functions that may be impacted by this include i2d_ASN1_bio_stream, BIO_new_CMS, BIO_new_PKCS7, i2d_CMS_bio_stream and i2d_PKCS7_bio_stream.
The OpenSSL cms and smime command line applications are similarly affected.
(CVE-2023-0215)
This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake.
When curl is asked to pass along the host name to the SOCKS5 proxy to allow that to resolve the address instead of it getting done by curl itself, the maximum length that host name can be is 255 bytes.
If the host name is detected to be longer, curl switches to local name resolving and instead passes on the resolved address only. Due to this bug, the local variable that means "let the host resolve the name" could get the wrong value during a slow SOCKS5 handshake, and contrary to the intention, copy the too long host name to the target buffer instead of copying just the resolved address there.
The target buffer being a heap based buffer, and the host name coming from the URL that curl has been told to operate with. (CVE-2023-38545)
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).(CVE-2024-21137)
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.36 and prior and 8.3.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).(CVE-2024-21159)
- Record
OESA-2024-2072- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2024-2073
mysql security update
The MySQL(TM) software delivers a very fast, multi-threaded, multi-user, and robust SQL (Structured Query Language) database server. MySQL Server is intended for mission-critical, heavy-load production systems as well as for embedding into mass-deployed software. MySQL is a trademark of Oracle and/or its affiliates
Security Fix(es):
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.36 and prior and 8.3.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).(CVE-2024-21159)
- Record
OESA-2024-2073- CVSS 3.1
- 4.9 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-21159
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.36 and prior and 8.3.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
- Record
UBUNTU-CVE-2024-21159- CVSS 3.1
- 4.9 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVAZL-50489 No score
CVE-2024-21159 affecting package mysql for versions less than 8.0.40-1
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.36 and prior and 8.3.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
- Record
AZL-50489- Updated
- 2026-11-02
OSVAZL-50520 No score
CVE-2024-21159 affecting package mysql for versions less than 8.0.40-1
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.36 and prior and 8.3.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
- Record
AZL-50520- Updated
- 2026-11-05
OSVCLSA-2025-1739820848 No score
mysql: Fix of 129 CVEs
- Update to MySQL 8.0.40
- CVEs fixed: CVE-2024-21201 CVE-2024-21236 CVE-2024-21230 CVE-2024-21160 CVE-2024-21196 CVE-2024-21239 CVE-2024-21173 CVE-2024-21193 CVE-2024-21159 CVE-2024-21135 CVE-2024-20996 CVE-2024-21166 CVE-2024-21157 CVE-2024-21231 CVE-2024-21199 CVE-2024-21207 CVE-2024-21194 CVE-2024-21238 CVE-2024-21218 CVE-2024-21203 CVE-2024-21162 CVE-2024-21213 CVE-2024-21219 CVE-2024-21163 CVE-2024-21241 CVE-2024-21125 CVE-2024-21134 CVE-2024-21130 CVE-2024-21198 CVE-2024-21142 CVE-2024-21127 CVE-2024-21237 CVE-2024-21197 CVE-2024-21212 CVE-2024-21247 CVE-2024-21129 CVE-2024-21200 CVE-2024-21171 CVE-2024-21165 CVE-2024-21137 CVE-2024-21061 CVE-2024-21057 CVE-2024-21056 CVE-2024-21055 CVE-2024-21053 CVE-2024-21052 CVE-2024-21051 CVE-2024-21050 CVE-2024-21049 CVE-2024-20993 CVE-2024-20984 CVE-2024-20982 CVE-2024-20970 CVE-2024-20968 CVE-2024-20966 CVE-2024-20964 CVE-2024-20962 CVE-2024-20960 CVE-2024-21179 CVE-2024-21185 CVE-2024-21177 CVE-2024-20972 CVE-2024-20976 CVE-2024-20974 CVE-2024-20978 CVE-2024-20981 CVE-2024-20969 CVE-2024-20985 CVE-2024-20965 CVE-2024-20967 CVE-2024-20977 CVE-2024-20961 CVE-2024-20983 CVE-2024-20963 CVE-2024-20971 CVE-2024-20973 CVE-2023-22103 CVE-2023-22070 CVE-2023-22114 CVE-2023-22079 CVE-2023-22066 CVE-2023-22104 CVE-2023-22084 CVE-2023-22078 CVE-2023-22111 CVE-2023-22064 CVE-2023-22113 CVE-2023-22097 CVE-2023-22065 CVE-2023-22092 CVE-2023-22110 CVE-2023-22059 CVE-2023-22068 CVE-2023-22115 CVE-2023-22032 CVE-2023-22112 CVE-2023-22033 CVE-2023-22048 CVE-2023-21950 CVE-2023-22058 CVE-2023-22008 CVE-2023-22007 CVE-2023-22046 CVE-2023-22054 CVE-2023-22005 CVE-2023-22056 CVE-2023-22038 CVE-2023-22053 CVE-2023-22057 CVE-2023-21935 CVE-2023-21972 CVE-2023-21953 CVE-2023-21977 CVE-2023-21962 CVE-2023-21955 CVE-2023-21946 CVE-2023-21920 CVE-2023-21919 CVE-2023-21980 CVE-2023-21929 CVE-2023-21982 CVE-2023-21966 CVE-2023-21945 CVE-2023-21911 CVE-2023-21933 CVE-2023-21976 CVE-2023-21940 CVE-2023-21947 CVE-2022-4899
- Record
CLSA-2025-1739820848- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mysqlAzure Linux:2 |
before 8.0.40-1 | 8.0.40-1 |
mysqlAzure Linux:3 |
before 8.0.40-1 | 8.0.40-1 |
mysqlTuxCare:AlmaLinux:9.2 From an advisory covering 129 CVEs |
before 8.0.40-1.el9_2.tuxcare.els1 | 8.0.40-1.el9_2.tuxcare.els1 |
mysql-commonTuxCare:AlmaLinux:9.2 From an advisory covering 129 CVEs |
before 8.0.40-1.el9_2.tuxcare.els1 | 8.0.40-1.el9_2.tuxcare.els1 |
mysql-develTuxCare:AlmaLinux:9.2 From an advisory covering 129 CVEs |
before 8.0.40-1.el9_2.tuxcare.els1 | 8.0.40-1.el9_2.tuxcare.els1 |
mysql-errmsgTuxCare:AlmaLinux:9.2 From an advisory covering 129 CVEs |
before 8.0.40-1.el9_2.tuxcare.els1 | 8.0.40-1.el9_2.tuxcare.els1 |
mysql-libsTuxCare:AlmaLinux:9.2 From an advisory covering 129 CVEs |
before 8.0.40-1.el9_2.tuxcare.els1 | 8.0.40-1.el9_2.tuxcare.els1 |
mysql-serverTuxCare:AlmaLinux:9.2 From an advisory covering 129 CVEs |
before 8.0.40-1.el9_2.tuxcare.els1 | 8.0.40-1.el9_2.tuxcare.els1 |
mysql-testTuxCare:AlmaLinux:9.2 From an advisory covering 129 CVEs |
before 8.0.40-1.el9_2.tuxcare.els1 | 8.0.40-1.el9_2.tuxcare.els1 |
mysqlopenEuler:22.03-LTS-SP3 From an advisory covering 2 CVEs |
before 8.0.38-1.oe2203sp3 | 8.0.38-1.oe2203sp3 |
Show 11 moreShow less
| Package | Affected | Fixed |
|---|---|---|
mysqlopenEuler:20.03-LTS-SP4 From an advisory covering 218 CVEs |
before 8.0.38-1.oe2003sp4 | 8.0.38-1.oe2003sp4 |
mysqlopenEuler:22.03-LTS-SP1 From an advisory covering 4 CVEs |
before 8.0.38-1.oe2203sp1 | 8.0.38-1.oe2203sp1 |
mysqlopenEuler:24.03-LTS |
before 8.0.38-1.oe2403 | 8.0.38-1.oe2403 |
mysql-5.5Ubuntu:14.04:LTS |
All versions, plus listed versions 5.5.32-0ubuntu75.5.34-0ubuntu15.5.34-0ubuntu25.5.35-0ubuntu15.5.35+dfsg-1ubuntu1 Show 20 moreShow less5.5.37-0ubuntu0.14.04.15.5.38-0ubuntu0.14.04.15.5.40-0ubuntu0.14.04.15.5.41-0ubuntu0.14.04.15.5.43-0ubuntu0.14.04.15.5.44-0ubuntu0.14.04.15.5.46-0ubuntu0.14.04.25.5.47-0ubuntu0.14.04.15.5.49-0ubuntu0.14.04.15.5.50-0ubuntu0.14.04.15.5.52-0ubuntu0.14.04.15.5.53-0ubuntu0.14.04.15.5.54-0ubuntu0.14.04.15.5.55-0ubuntu0.14.04.15.5.57-0ubuntu0.14.04.15.5.58-0ubuntu0.14.04.15.5.59-0ubuntu0.14.04.15.5.60-0ubuntu0.14.04.15.5.61-0ubuntu0.14.04.15.5.62-0ubuntu0.14.04.1 |
None known |
mysql-5.7Ubuntu:Pro:16.04:LTS |
All versions, plus listed versions 5.7.11-0ubuntu45.7.11-0ubuntu55.7.11-0ubuntu65.7.12-0ubuntu15.7.12-0ubuntu1.1 Show 31 moreShow less5.7.13-0ubuntu0.16.04.25.7.15-0ubuntu0.16.04.15.7.16-0ubuntu0.16.04.15.7.17-0ubuntu0.16.04.15.7.17-0ubuntu0.16.04.25.7.18-0ubuntu0.16.04.15.7.19-0ubuntu0.16.04.15.7.20-0ubuntu0.16.04.15.7.21-0ubuntu0.16.04.15.7.22-0ubuntu0.16.04.15.7.23-0ubuntu0.16.04.15.7.24-0ubuntu0.16.04.15.7.25-0ubuntu0.16.04.25.7.26-0ubuntu0.16.04.15.7.27-0ubuntu0.16.04.15.7.28-0ubuntu0.16.04.25.7.29-0ubuntu0.16.04.15.7.30-0ubuntu0.16.04.15.7.31-0ubuntu0.16.04.15.7.32-0ubuntu0.16.04.15.7.33-0ubuntu0.16.04.15.7.35-0ubuntu0.16.04.1+esm15.7.36-0ubuntu0.16.04.1+esm15.7.37-0ubuntu0.16.04.1+esm15.7.38-0ubuntu0.16.04.1+esm15.7.39-0ubuntu0.16.04.1+esm25.7.40-0ubuntu0.16.04.1+esm15.7.41-0ubuntu0.16.04.1+esm15.7.42-0ubuntu0.16.04.1+esm15.7.43-0ubuntu0.16.04.1+esm15.7.44-0ubuntu0.16.04.1+esm1 |
None known |
percona-server-5.6Ubuntu:16.04:LTS |
All versions, plus listed versions 5.6.22-rel71.0-0ubuntu25.6.22-rel71.0-0ubuntu45.6.22-rel71.0-0ubuntu4.1 |
None known |
percona-xtradb-cluster-5.6Ubuntu:16.04:LTS |
All versions, plus listed versions 5.6.21-25.8-0ubuntu25.6.21-25.8-0ubuntu35.6.21-25.8-0ubuntu3.15.6.21-25.8-0ubuntu3.25.6.34-26.19-0ubuntu0.16.04.15.6.34-26.19-0ubuntu0.16.04.25.6.37-26.21-0ubuntu0.16.04.15.6.37-26.21-0ubuntu0.16.04.2 |
None known |
mysql-5.7Ubuntu:Pro:18.04:LTS |
All versions, plus listed versions 5.7.19-0ubuntu15.7.20-0ubuntu0.17.10.15.7.20-1ubuntu15.7.21-1ubuntu15.7.22-0ubuntu18.04.1 Show 23 moreShow less5.7.23-0ubuntu0.18.04.15.7.24-0ubuntu0.18.04.15.7.25-0ubuntu0.18.04.25.7.26-0ubuntu0.18.04.15.7.27-0ubuntu0.18.04.15.7.28-0ubuntu0.18.04.45.7.29-0ubuntu0.18.04.15.7.30-0ubuntu0.18.04.15.7.31-0ubuntu0.18.04.15.7.32-0ubuntu0.18.04.15.7.33-0ubuntu0.18.04.15.7.34-0ubuntu0.18.04.15.7.35-0ubuntu0.18.04.15.7.35-0ubuntu0.18.04.25.7.36-0ubuntu0.18.04.15.7.37-0ubuntu0.18.04.15.7.38-0ubuntu0.18.04.15.7.39-0ubuntu0.18.04.25.7.40-0ubuntu0.18.04.15.7.41-0ubuntu0.18.04.15.7.42-0ubuntu0.18.04.15.7.43-0ubuntu0.18.04.1+esm15.7.44-0ubuntu0.18.04.1+esm1 |
None known |
mysql-8.0Ubuntu:20.04:LTS |
before 8.0.37-0ubuntu0.20.04.3, plus listed versions 8.0.17-0ubuntu28.0.17-0ubuntu38.0.18-0ubuntu38.0.18-0ubuntu48.0.18-0ubuntu5 Show 28 moreShow less8.0.19-0ubuntu28.0.19-0ubuntu38.0.19-0ubuntu48.0.19-0ubuntu58.0.20-0ubuntu0.20.04.18.0.21-0ubuntu0.20.04.38.0.21-0ubuntu0.20.04.48.0.22-0ubuntu0.20.04.28.0.22-0ubuntu0.20.04.38.0.23-0ubuntu0.20.04.18.0.25-0ubuntu0.20.04.18.0.26-0ubuntu0.20.04.28.0.26-0ubuntu0.20.04.38.0.27-0ubuntu0.20.04.18.0.28-0ubuntu0.20.04.38.0.29-0ubuntu0.20.04.28.0.29-0ubuntu0.20.04.38.0.30-0ubuntu0.20.04.28.0.31-0ubuntu0.20.04.18.0.31-0ubuntu0.20.04.28.0.32-0buntu0.20.04.18.0.32-0ubuntu0.20.04.28.0.33-0ubuntu0.20.04.18.0.33-0ubuntu0.20.04.28.0.33-0ubuntu0.20.04.48.0.34-0ubuntu0.20.04.18.0.35-0ubuntu0.20.04.18.0.36-0ubuntu0.20.04.1 |
8.0.37-0ubuntu0.20.04.3 |
mysql-8.0Ubuntu:22.04:LTS |
before 8.0.37-0ubuntu0.22.04.3, plus listed versions 8.0.26-0ubuntu18.0.27-0ubuntu0.21.10.18.0.28-0ubuntu38.0.28-0ubuntu48.0.29-0ubuntu0.22.04.1 Show 12 moreShow less8.0.29-0ubuntu0.22.04.28.0.29-0ubuntu0.22.04.38.0.30-0ubuntu0.22.04.18.0.31-0ubuntu0.22.04.18.0.32-0buntu0.22.04.18.0.32-0ubuntu0.22.04.28.0.33-0ubuntu0.22.04.18.0.33-0ubuntu0.22.04.28.0.33-0ubuntu0.22.04.48.0.34-0ubuntu0.22.04.18.0.35-0ubuntu0.22.04.18.0.36-0ubuntu0.22.04.1 |
8.0.37-0ubuntu0.22.04.3 |
mysql-8.0Ubuntu:24.04:LTS |
before 8.0.37-0ubuntu0.24.04.1, plus listed versions 8.0.34-1ubuntu18.0.35-1ubuntu18.0.35-1ubuntu28.0.36-18.0.36-2ubuntu18.0.36-2ubuntu28.0.36-2ubuntu3 |
8.0.37-0ubuntu0.24.04.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-21159 is a medium vulnerability (CVSS 4.9) in Oracle Mysql, published July 16, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.79%, the 56th percentile. Fixed in mysql 8.0.40-1.
References
oracle.com/security-alerts/cpujul2024.html
security.netapp.com/advisory/ntap-20240801-0002
nvd.nist.gov/vuln/detail/CVE-2024-21159
github.com/advisories/GHSA-qj89-gqxq-9f84
errata.tuxcare.com/almalinux9.2-esu/CLSA-2025-1739820848.html
Show 194 moreShow less
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2024-2070
ubuntu.com/security/CVE-2024-21159
cve.org/CVERecord?id=CVE-2024-21159
Left out here: 29 references and the rest of 1 source description. The JSON record has them.