Bug 57005 - mariadb-10.3: Multiple issues (5.0)
mariadb-10.3: Multiple issues (5.0)
Status: CLOSED FIXED
Product: UCS
Classification: Unclassified
Component: Security updates
UCS 5.0
All Linux
: P3 normal (vote)
: UCS 5.0-6-errata
Assigned To: Quality Assurance
Iván.Delgado
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2024-01-29 08:03 CET by Quality Assurance
Modified: 2024-01-31 15:39 CET (History)
0 users

See Also:
What kind of report is it?: Security Issue
What type of bug is this?: ---
Who will be affected by this bug?: ---
How will those affected feel about the bug?: ---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional):
Max CVSS v3 score: 4.9 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Quality Assurance univentionstaff 2024-01-29 08:03:35 CET
New Debian mariadb-10.3 1:10.3.39-0+deb10u2 fixes:
This update addresses the following issue:
1:10.3.39-0+deb10u2 (Sat, 20 Jan 2024 21:31:44 +0000)
* Non-maintainer upload by the LTS Security Team.
* Fix CVE-2023-22084: A vulnerability allowed high privileged attacker with  network access via multiple protocols to compromise the server. Successful  attacks of this vulnerability can result in unauthorized ability to cause a  hang or frequently repeatable crash (complete DOS) the server
Comment 1 Quality Assurance univentionstaff 2024-01-29 09:00:34 CET
--- mirror/ftp/pool/main/m/mariadb-10.3/mariadb-10.3_10.3.39-0+deb10u1.dsc
+++ apt/ucs_5.0-0-errata5.0-6/source/mariadb-10.3_10.3.39-0+deb10u2.dsc
@@ -1,3 +1,14 @@
+1:10.3.39-0+deb10u2 [Sat, 20 Jan 2024 21:31:44 +0000] Bastien Roucariès <rouca@debian.org>:
+
+  * Non-maintainer upload by the LTS Security Team.
+  * Fix CVE-2023-22084: A vulnerability allowed
+    high privileged attacker with network access
+    via multiple protocols to compromise the server.
+    Successful attacks of this vulnerability can result
+    in unauthorized ability to cause a hang or
+    frequently repeatable crash (complete DOS) the server
+    (Closes: #1055034)
+
 1:10.3.39-0+deb10u1 [Sat, 03 Jun 2023 18:57:44 -0700] Otto Kekäläinen <otto@debian.org>:
 
   * New upstream version 10.3.39. Includes security fixes for:

<http://piuparts.knut.univention.de/5.0-6/#3984503307394461039>
Comment 2 Iván.Delgado univentionstaff 2024-01-30 09:07:20 CET
OK: bug
OK: yaml
OK: announce_errata
OK: patch
~OK: piuparts
  Files left after package purge. Not an issue for this update

[5.0-6] 0a0aea37c2 Bug #57005: mariadb-10.3 1:10.3.39-0+deb10u2
 doc/errata/staging/mariadb-10.3.yaml | 14 ++++++--------
 1 file changed, 6 insertions(+), 8 deletions(-)

[5.0-6] 93fe953d41 Bug #57005: mariadb-10.3 1:10.3.39-0+deb10u2
 doc/errata/staging/mariadb-10.3.yaml | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)