OESA-2026-2397

See a problem?
Please try reporting it to the source first.
Source
https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2026-2397
Import Source
https://repo.openeuler.org/security/data/osv/OESA-2026-2397.json
JSON Data
https://api.osv.dev/v1/vulns/OESA-2026-2397
Upstream
  • CVE-2025-13699
Published
2026-05-22T13:18:31Z
Modified
2026-05-22T13:30:18.465659093Z
Summary
mariadb security update
Details

MariaDB is a community developed fork from MySQL - a multi-user, multi-threaded SQL database server. It is a client/server implementation consisting of a server daemon (mariadbd) and many different client programs and libraries. The base package contains the standard MariaDB/MySQL client programs and utilities.

Security Fix(es):

MariaDB mariadb-dump Utility Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MariaDB. Interaction with the mariadb-dump utility is required to exploit this vulnerability but attack vectors may vary depending on the implementation.

The specific flaw exists within the handling of view names. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27000.(CVE-2025-13699)

In MariaDB server version through 11.8.5, when server audit plugin is enabled with serverauditevents variable configured with QUERYDCL, QUERYDDL, or QUERY_DML filtering, if an authenticated database user invokes a SQL statement prefixed with double-hyphen (—) or hash (#) style comments, the statement is not logged.(CVE-2026-3494)

Database specific 
{
    "severity": "High"
}
References

Affected packages

openEuler:24.03-LTS / mariadb

Package

Name
mariadb
Purl
pkg:rpm/openEuler/mariadb&distro=openEuler-24.03-LTS

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
10.5.29-4.oe2403

Ecosystem specific 

{
    "x86_64": [
        "mariadb-10.5.29-4.oe2403.x86_64.rpm",
        "mariadb-backup-10.5.29-4.oe2403.x86_64.rpm",
        "mariadb-common-10.5.29-4.oe2403.x86_64.rpm",
        "mariadb-config-10.5.29-4.oe2403.x86_64.rpm",
        "mariadb-debuginfo-10.5.29-4.oe2403.x86_64.rpm",
        "mariadb-debugsource-10.5.29-4.oe2403.x86_64.rpm",
        "mariadb-devel-10.5.29-4.oe2403.x86_64.rpm",
        "mariadb-embedded-10.5.29-4.oe2403.x86_64.rpm",
        "mariadb-embedded-devel-10.5.29-4.oe2403.x86_64.rpm",
        "mariadb-errmsg-10.5.29-4.oe2403.x86_64.rpm",
        "mariadb-gssapi-server-10.5.29-4.oe2403.x86_64.rpm",
        "mariadb-oqgraph-engine-10.5.29-4.oe2403.x86_64.rpm",
        "mariadb-pam-10.5.29-4.oe2403.x86_64.rpm",
        "mariadb-server-10.5.29-4.oe2403.x86_64.rpm",
        "mariadb-server-galera-10.5.29-4.oe2403.x86_64.rpm",
        "mariadb-server-utils-10.5.29-4.oe2403.x86_64.rpm",
        "mariadb-test-10.5.29-4.oe2403.x86_64.rpm"
    ],
    "src": [
        "mariadb-10.5.29-4.oe2403.src.rpm"
    ],
    "aarch64": [
        "mariadb-10.5.29-4.oe2403.aarch64.rpm",
        "mariadb-backup-10.5.29-4.oe2403.aarch64.rpm",
        "mariadb-common-10.5.29-4.oe2403.aarch64.rpm",
        "mariadb-config-10.5.29-4.oe2403.aarch64.rpm",
        "mariadb-debuginfo-10.5.29-4.oe2403.aarch64.rpm",
        "mariadb-debugsource-10.5.29-4.oe2403.aarch64.rpm",
        "mariadb-devel-10.5.29-4.oe2403.aarch64.rpm",
        "mariadb-embedded-10.5.29-4.oe2403.aarch64.rpm",
        "mariadb-embedded-devel-10.5.29-4.oe2403.aarch64.rpm",
        "mariadb-errmsg-10.5.29-4.oe2403.aarch64.rpm",
        "mariadb-gssapi-server-10.5.29-4.oe2403.aarch64.rpm",
        "mariadb-oqgraph-engine-10.5.29-4.oe2403.aarch64.rpm",
        "mariadb-pam-10.5.29-4.oe2403.aarch64.rpm",
        "mariadb-rocksdb-engine-10.5.29-4.oe2403.aarch64.rpm",
        "mariadb-server-10.5.29-4.oe2403.aarch64.rpm",
        "mariadb-server-galera-10.5.29-4.oe2403.aarch64.rpm",
        "mariadb-server-utils-10.5.29-4.oe2403.aarch64.rpm",
        "mariadb-test-10.5.29-4.oe2403.aarch64.rpm"
    ]
}

Database specific

source 
"https://repo.openeuler.org/security/data/osv/OESA-2026-2397.json"