OESA-2022-1682

Source
https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2022-1682
Import Source
https://repo.openeuler.org/security/data/osv/OESA-2022-1682.json
JSON Data
https://api.osv.dev/v1/vulns/OESA-2022-1682
Upstream
Published
2022-05-28T11:03:49Z
Modified
2025-09-03T06:17:13.725833Z
Summary
mysql5 security update
Details

MySQL is a multi-user, multi-threaded SQL database server. MySQL is a client/server implementation consisting of a server daemon (mysqld) and many different client programs and libraries. The base package contains the standard MySQL client programs and generic MySQL files.

Security Fix(es):

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.37 and prior and 8.0.28 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).(CVE-2022-21451)

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.37 and prior and 8.0.28 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).(CVE-2022-21417)

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema). Supported versions that are affected are 5.7.33 and prior and 8.0.23 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Server accessible data. CVSS 3.1 Base Score 4.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N).(CVE-2021-2226)

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 5.7.37 and prior and 8.0.28 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).(CVE-2022-21444)

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Logging). Supported versions that are affected are 5.7.37 and prior and 8.0.28 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Server accessible data. CVSS 3.1 Base Score 4.4 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).(CVE-2022-21460)

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: FTS). Supported versions that are affected are 5.7.37 and prior and 8.0.28 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).(CVE-2022-21427)

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Group Replication Plugin). Supported versions that are affected are 5.7.37 and prior and 8.0.28 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).(CVE-2022-21454)

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 5.7.36 and prior and 8.0.27 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.1 Base Score 4.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N).(CVE-2022-21245)

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 5.7.32 and prior and 8.0.22 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).(CVE-2021-2202)

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 5.7.33 and prior and 8.0.23 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).(CVE-2021-2171)

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.6.50 and prior, 5.7.32 and prior and 8.0.22 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).(CVE-2021-2022)

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Group Replication Plugin). Supported versions that are affected are 5.7.33 and prior and 8.0.23 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).(CVE-2021-2179)

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.33 and prior and 8.0.23 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).(CVE-2021-2174)

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.33 and prior and 8.0.23 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).(CVE-2021-2194)

Vulnerability in the MySQL Server product of Oracle MySQL (component: Information Schema). Supported versions that are affected are 5.7.32 and prior and 8.0.22 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Server accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).(CVE-2021-2032)

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 5.7.30 and prior and 8.0.17 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).(CVE-2021-2160)

Database specific
{
    "severity": "Medium"
}
References

Affected packages

openEuler:20.03-LTS-SP1 / mysql5

Package

Name
mysql5
Purl
pkg:rpm/openEuler/mysql5&distro=openEuler-20.03-LTS-SP1

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.7.38-1.oe1

Ecosystem specific

{
    "src": [
        "mysql5-5.7.38-1.oe1.src.rpm"
    ],
    "aarch64": [
        "mysql5-5.7.38-1.oe1.aarch64.rpm",
        "mysql5-common-5.7.38-1.oe1.aarch64.rpm",
        "mysql5-debuginfo-5.7.38-1.oe1.aarch64.rpm",
        "mysql5-debugsource-5.7.38-1.oe1.aarch64.rpm",
        "mysql5-devel-5.7.38-1.oe1.aarch64.rpm",
        "mysql5-embedded-5.7.38-1.oe1.aarch64.rpm",
        "mysql5-embedded-devel-5.7.38-1.oe1.aarch64.rpm",
        "mysql5-errmsg-5.7.38-1.oe1.aarch64.rpm",
        "mysql5-libs-5.7.38-1.oe1.aarch64.rpm",
        "mysql5-server-5.7.38-1.oe1.aarch64.rpm",
        "mysql5-test-5.7.38-1.oe1.aarch64.rpm"
    ],
    "x86_64": [
        "mysql5-5.7.38-1.oe1.x86_64.rpm",
        "mysql5-common-5.7.38-1.oe1.x86_64.rpm",
        "mysql5-debuginfo-5.7.38-1.oe1.x86_64.rpm",
        "mysql5-debugsource-5.7.38-1.oe1.x86_64.rpm",
        "mysql5-devel-5.7.38-1.oe1.x86_64.rpm",
        "mysql5-embedded-5.7.38-1.oe1.x86_64.rpm",
        "mysql5-embedded-devel-5.7.38-1.oe1.x86_64.rpm",
        "mysql5-errmsg-5.7.38-1.oe1.x86_64.rpm",
        "mysql5-libs-5.7.38-1.oe1.x86_64.rpm",
        "mysql5-server-5.7.38-1.oe1.x86_64.rpm",
        "mysql5-test-5.7.38-1.oe1.x86_64.rpm"
    ]
}

openEuler:20.03-LTS-SP3 / mysql5

Package

Name
mysql5
Purl
pkg:rpm/openEuler/mysql5&distro=openEuler-20.03-LTS-SP3

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.7.38-1.oe1

Ecosystem specific

{
    "src": [
        "mysql5-5.7.38-1.oe1.src.rpm"
    ],
    "aarch64": [
        "mysql5-5.7.38-1.oe1.aarch64.rpm",
        "mysql5-common-5.7.38-1.oe1.aarch64.rpm",
        "mysql5-debuginfo-5.7.38-1.oe1.aarch64.rpm",
        "mysql5-debugsource-5.7.38-1.oe1.aarch64.rpm",
        "mysql5-devel-5.7.38-1.oe1.aarch64.rpm",
        "mysql5-embedded-5.7.38-1.oe1.aarch64.rpm",
        "mysql5-embedded-devel-5.7.38-1.oe1.aarch64.rpm",
        "mysql5-errmsg-5.7.38-1.oe1.aarch64.rpm",
        "mysql5-libs-5.7.38-1.oe1.aarch64.rpm",
        "mysql5-server-5.7.38-1.oe1.aarch64.rpm",
        "mysql5-test-5.7.38-1.oe1.aarch64.rpm"
    ],
    "x86_64": [
        "mysql5-5.7.38-1.oe1.x86_64.rpm",
        "mysql5-common-5.7.38-1.oe1.x86_64.rpm",
        "mysql5-debuginfo-5.7.38-1.oe1.x86_64.rpm",
        "mysql5-debugsource-5.7.38-1.oe1.x86_64.rpm",
        "mysql5-devel-5.7.38-1.oe1.x86_64.rpm",
        "mysql5-embedded-5.7.38-1.oe1.x86_64.rpm",
        "mysql5-embedded-devel-5.7.38-1.oe1.x86_64.rpm",
        "mysql5-errmsg-5.7.38-1.oe1.x86_64.rpm",
        "mysql5-libs-5.7.38-1.oe1.x86_64.rpm",
        "mysql5-server-5.7.38-1.oe1.x86_64.rpm",
        "mysql5-test-5.7.38-1.oe1.x86_64.rpm"
    ]
}

openEuler:22.03-LTS / mysql5

Package

Name
mysql5
Purl
pkg:rpm/openEuler/mysql5&distro=openEuler-22.03-LTS

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.7.38-1.oe2203

Ecosystem specific

{
    "src": [
        "mysql5-5.7.38-1.oe2203.src.rpm"
    ],
    "aarch64": [
        "mysql5-5.7.38-1.oe2203.aarch64.rpm",
        "mysql5-common-5.7.38-1.oe2203.aarch64.rpm",
        "mysql5-debuginfo-5.7.38-1.oe2203.aarch64.rpm",
        "mysql5-debugsource-5.7.38-1.oe2203.aarch64.rpm",
        "mysql5-devel-5.7.38-1.oe2203.aarch64.rpm",
        "mysql5-embedded-5.7.38-1.oe2203.aarch64.rpm",
        "mysql5-embedded-devel-5.7.38-1.oe2203.aarch64.rpm",
        "mysql5-errmsg-5.7.38-1.oe2203.aarch64.rpm",
        "mysql5-libs-5.7.38-1.oe2203.aarch64.rpm",
        "mysql5-server-5.7.38-1.oe2203.aarch64.rpm",
        "mysql5-test-5.7.38-1.oe2203.aarch64.rpm"
    ],
    "x86_64": [
        "mysql5-5.7.38-1.oe2203.x86_64.rpm",
        "mysql5-common-5.7.38-1.oe2203.x86_64.rpm",
        "mysql5-debuginfo-5.7.38-1.oe2203.x86_64.rpm",
        "mysql5-debugsource-5.7.38-1.oe2203.x86_64.rpm",
        "mysql5-devel-5.7.38-1.oe2203.x86_64.rpm",
        "mysql5-embedded-5.7.38-1.oe2203.x86_64.rpm",
        "mysql5-embedded-devel-5.7.38-1.oe2203.x86_64.rpm",
        "mysql5-errmsg-5.7.38-1.oe2203.x86_64.rpm",
        "mysql5-libs-5.7.38-1.oe2203.x86_64.rpm",
        "mysql5-server-5.7.38-1.oe2203.x86_64.rpm",
        "mysql5-test-5.7.38-1.oe2203.x86_64.rpm"
    ]
}