CVE-2022-39408

high

Published 2023-05-09 · Modified 2023-05-16

💬 Discuss on Community ✚ Propose mitigation

CVSS v3

—

CVSS v4 NEW

—

not yet in upstream

VIR risk

8.0

Description

RHSA-2023:3087: mysql:8.0 security, bug fix, and enhancement update (Important)

Predictions

Exploit likelihood

20%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

Mitigation details

Source: Red Hat Errata — Red Hat Inc. · View original ↗ · Open-Errata-API

Description mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2022) CVSS v3: 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Errata / fixed releases ProductPackageAdvisoryReleased Red Hat Enterprise Linux 8mysql:8.0-8080020230322094358.63b34585RHSA-2023:30872023-05-16T00:00:00Z Red Hat Enterprise Linux 9mysql-0:8.0.32-1.el9_2RHSA-2023:26212023-05-09T00:00:00Z Red Hat Software…

Description

mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2022)

CVSS v3: 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Errata / fixed releases

Product	Package	Advisory	Released
Red Hat Enterprise Linux 8	`mysql:8.0-8080020230322094358.63b34585`	RHSA-2023:3087	2023-05-16T00:00:00Z
Red Hat Enterprise Linux 9	`mysql-0:8.0.32-1.el9_2`	RHSA-2023:2621	2023-05-09T00:00:00Z
Red Hat Software Collections for Red Hat Enterprise Linux 7	`rh-mysql80-mysql-0:8.0.32-1.el7`	RHSA-2023:1102	2023-03-07T00:00:00Z

Package state

Product	Package	State
Red Hat Enterprise Linux 6	`mysql`	Not affected
Red Hat Enterprise Linux 7	`mariadb`	Not affected
Red Hat Enterprise Linux 8	`mariadb:10.3/mariadb`	Not affected
Red Hat Enterprise Linux 8	`mariadb:10.5/mariadb`	Not affected
Red Hat Enterprise Linux 9	`mariadb`	Not affected
Red Hat OpenStack Platform 13 (Queens)	`mariadb`	Not affected
Red Hat Software Collections	`rh-mariadb103-mariadb`	Not affected
Red Hat Software Collections	`rh-mariadb105-mariadb`	Not affected

Apply commands

bash fix

Apply RHSA-2023:3087 for Red Hat Enterprise Linux 8

yum update -y mysql:8
# or:
dnf upgrade -y mysql:8

Affected

Vendor	Product	Version
redhat	Red Hat Enterprise Linux 6	`Not affected`
redhat	Red Hat Enterprise Linux 7	`Not affected`
redhat	Red Hat Enterprise Linux 8	`Not affected`
redhat	Red Hat Enterprise Linux 8	`Not affected`
redhat	Red Hat Enterprise Linux 9	`Not affected`
redhat	Red Hat OpenStack Platform 13 (Queens)	`Not affected`
redhat	Red Hat Software Collections	`Not affected`
redhat	Red Hat Software Collections	`Not affected`

OS impact

AlmaLinux Fixed 2 releases

Version	Status	Fixed in
9	Fixed	`mysql-8.0.32-1.el9_2.aarch64.rpm`
8	Fixed	`mecab-devel-0.996-2.module_el8.6.0+3340+d764b636.x86_64.rpm`

Debian Fixed 1 release

Version	Status	Fixed in
sid	Fixed	`8.0.31-1`

Red Hat Fixed 2 releases

Version	Status	Fixed in
9	Fixed	—
8	Fixed	—

References

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.