mariadb: server crash in JOIN_CACHE::free or in copy_fields
Published Jul 1, 2022
7.5
HIGHCVSS 3.1
EPSS 2.37%
Description
MariaDB v10.7 was discovered to contain an use-after-poison in in __interceptor_memset at /libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc.
Affected products
No data.
Configuration 1
- ≥ 10.3.0 · < 10.3.36
- ≥ 10.4.0 · < 10.4.26
- ≥ 10.5.0 · < 10.5.17
- ≥ 10.6.0 · < 10.6.9
- ≥ 10.7.0 · < 10.7.5
- ≥ 10.8.0 · < 10.8.4
- ≥ 10.9.0 · < 10.9.2
Configuration 2
- 10.0
Configuration 3
- 35
- 36
- 37
No data.
Red Hat Enterprise Linux 8
mariadb:10.3-8080020230814130040.63b34585
Fixed · RHSA-2023:5259
Red Hat Enterprise Linux 8
mariadb:10.5-8080020231003163755.63b34585
Fixed · RHSA-2023:5683
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
mariadb:10.5-8040020231006044227.522a0ee4
Fixed · RHSA-2023:6821
Red Hat Enterprise Linux 8.4 Telecommunications Update Service
mariadb:10.5-8040020231006044227.522a0ee4
Fixed · RHSA-2023:6821
Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions
mariadb:10.5-8040020231006044227.522a0ee4
Fixed · RHSA-2023:6821
Red Hat Enterprise Linux 8.6 Extended Update Support
mariadb:10.5-8060020231005052631.ad008a3a
Fixed · RHSA-2023:6822
Red Hat Enterprise Linux 9
mariadb-3:10.5.22-1.el9_2
Fixed · RHSA-2023:5684
Red Hat Enterprise Linux 9.0 Extended Update Support
galera-0:26.4.14-1.el9_0
Fixed · RHSA-2023:6883
Red Hat Enterprise Linux 9.0 Extended Update Support
mariadb-3:10.5.22-1.el9_0
Fixed · RHSA-2023:6883
Red Hat Software Collections for Red Hat Enterprise Linux 7
rh-mariadb105-mariadb-3:10.5.22-1.el7
Fixed · RHSA-2023:7633
Red Hat Enterprise Linux 7
mariadb
Out of support scope
Red Hat OpenStack Platform 13 (Queens)
mariadb
Out of support scope
Red Hat Software Collections
rh-mariadb103-mariadb
Will not fix
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 8 | mariadb:10.3-8080020230814130040.63b34585 | Fixed | RHSA-2023:5259 |
| Red Hat Enterprise Linux 8 | mariadb:10.5-8080020231003163755.63b34585 | Fixed | RHSA-2023:5683 |
| Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | mariadb:10.5-8040020231006044227.522a0ee4 | Fixed | RHSA-2023:6821 |
| Red Hat Enterprise Linux 8.4 Telecommunications Update Service | mariadb:10.5-8040020231006044227.522a0ee4 | Fixed | RHSA-2023:6821 |
| Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions | mariadb:10.5-8040020231006044227.522a0ee4 | Fixed | RHSA-2023:6821 |
| Red Hat Enterprise Linux 8.6 Extended Update Support | mariadb:10.5-8060020231005052631.ad008a3a | Fixed | RHSA-2023:6822 |
| Red Hat Enterprise Linux 9 | mariadb-3:10.5.22-1.el9_2 | Fixed | RHSA-2023:5684 |
| Red Hat Enterprise Linux 9.0 Extended Update Support | galera-0:26.4.14-1.el9_0 | Fixed | RHSA-2023:6883 |
| Red Hat Enterprise Linux 9.0 Extended Update Support | mariadb-3:10.5.22-1.el9_0 | Fixed | RHSA-2023:6883 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 | rh-mariadb105-mariadb-3:10.5.22-1.el7 | Fixed | RHSA-2023:7633 |
| Red Hat Enterprise Linux 7 | mariadb | Out of support scope | n/a |
| Red Hat OpenStack Platform 13 (Queens) | mariadb | Out of support scope | n/a |
| Red Hat Software Collections | rh-mariadb103-mariadb | Will not fix | n/a |
No package ranges for this CVE.
Remediation
No remediation recorded yet.
References (10)
- https://access.redhat.com/security/cve/CVE-2022-32091 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2106042 Issue Tracking
- https://jira.mariadb.org/browse/MDEV-26431 ExploitIssue TrackingThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2022/09/msg00023.html mailing-listMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WCOEGSVMIEXDZHBOSV6WVF7FAVRBR2JE/ vendor-advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WTVAONAZXJFGHAJ4RP2OF3EAMQCOTDSQ/ vendor-advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZHISY4YVO4S5QJYYIXCIAXBM7INOL4VY/ vendor-advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-32091
- https://security.netapp.com/advisory/ntap-20220818-0005/ Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2022-32091
| Link | Providers | Tags |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2022-32091 | Vendor Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2106042 | Issue Tracking | |
| https://jira.mariadb.org/browse/MDEV-26431 | ExploitIssue TrackingThird Party Advisory | |
| https://lists.debian.org/debian-lts-announce/2022/09/msg00023.html | mailing-listMailing ListThird Party Advisory | |
| https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WCOEGSVMIEXDZHBOSV6WVF7FAVRBR2JE/ | vendor-advisory | |
| https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WTVAONAZXJFGHAJ4RP2OF3EAMQCOTDSQ/ | vendor-advisory | |
| https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZHISY4YVO4S5QJYYIXCIAXBM7INOL4VY/ | vendor-advisory | |
| https://nvd.nist.gov/vuln/detail/CVE-2022-32091 | ||
| https://security.netapp.com/advisory/ntap-20220818-0005/ | Third Party Advisory | |
| https://www.cve.org/CVERecord?id=CVE-2022-32091 |
Change history (0)
No recorded changes yet.