CVE-2022-21525

一、漏洞信息
漏洞编号：CVE-2022-21525
漏洞归属组件：mysql
漏洞归属的版本：8.0.17,8.0.23,8.0.24,8.0.26,8.0.27,8.0.28,8.0.29,8.0.30
CVSS V3.0分值：
BaseScore：4.9 Medium
Vector：CVSS：3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
漏洞简述：
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.29 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
漏洞公开时间：2022-07-20 06:15:10
漏洞创建时间：2022-07-21 09:22:26
漏洞详情参考链接：
https://nvd.nist.gov/vuln/detail/CVE-2022-21525

更多参考(点击展开)

参考来源	参考链接	来源链接
secalert_us.oracle.com	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3CESCYUGY6H6O2R2GPUJLBTYSMY2PHCD/
secalert_us.oracle.com	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZI4Q7XW5QLUTOACRHBIEYZ6SZB6TIEMT/
secalert_us.oracle.com	https://security.netapp.com/advisory/ntap-20220729-0004/
secalert_us.oracle.com	https://www.oracle.com/security-alerts/cpujul2022.html
redhat_bugzilla	https://www.oracle.com/security-alerts/cpujul2022.html#AppendixMSQL	https://bugzilla.redhat.com/show_bug.cgi?id=2115287
redhat_bugzilla	https://access.redhat.com/errata/RHSA-2022:6518	https://bugzilla.redhat.com/show_bug.cgi?id=2115287
redhat_bugzilla	https://access.redhat.com/errata/RHSA-2022:6590	https://bugzilla.redhat.com/show_bug.cgi?id=2115287
redhat_bugzilla	https://access.redhat.com/errata/RHSA-2022:7119	https://bugzilla.redhat.com/show_bug.cgi?id=2115287
redhat_bugzilla	https://access.redhat.com/security/cve/cve-2022-21525	https://bugzilla.redhat.com/show_bug.cgi?id=2115287
ubuntu	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21525	https://ubuntu.com/security/CVE-2022-21525
ubuntu	https://www.oracle.com/security-alerts/cpujul2022.html	https://ubuntu.com/security/CVE-2022-21525
ubuntu	https://ubuntu.com/security/notices/USN-5537-1	https://ubuntu.com/security/CVE-2022-21525
ubuntu	https://nvd.nist.gov/vuln/detail/CVE-2022-21525	https://ubuntu.com/security/CVE-2022-21525
ubuntu	https://launchpad.net/bugs/cve/CVE-2022-21525	https://ubuntu.com/security/CVE-2022-21525
ubuntu	https://security-tracker.debian.org/tracker/CVE-2022-21525	https://ubuntu.com/security/CVE-2022-21525
debian		https://security-tracker.debian.org/tracker/CVE-2022-21525
oracle		https://www.oracle.com/security-alerts/linuxbulletinoct2022.html
anolis		https://anas.openanolis.cn/cves/detail/CVE-2022-21525
cve_search		https://www.oracle.com/security-alerts/cpujul2022.html
cve_search		https://security.netapp.com/advisory/ntap-20220729-0004/
cve_search		https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZI4Q7XW5QLUTOACRHBIEYZ6SZB6TIEMT/
cve_search		https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3CESCYUGY6H6O2R2GPUJLBTYSMY2PHCD/
osv	https://errata.rockylinux.org/RLSA-2022:6590	https://osv.dev/vulnerability/RLSA-2022:6590
osv	https://bugzilla.redhat.com/show_bug.cgi?id=2082636	https://osv.dev/vulnerability/RLSA-2022:6590
osv	https://bugzilla.redhat.com/show_bug.cgi?id=2082637	https://osv.dev/vulnerability/RLSA-2022:6590
osv	https://bugzilla.redhat.com/show_bug.cgi?id=2082638	https://osv.dev/vulnerability/RLSA-2022:6590
osv	https://bugzilla.redhat.com/show_bug.cgi?id=2082639	https://osv.dev/vulnerability/RLSA-2022:6590
osv	https://bugzilla.redhat.com/show_bug.cgi?id=2082640	https://osv.dev/vulnerability/RLSA-2022:6590
osv	https://bugzilla.redhat.com/show_bug.cgi?id=2082641	https://osv.dev/vulnerability/RLSA-2022:6590
osv	https://bugzilla.redhat.com/show_bug.cgi?id=2082642	https://osv.dev/vulnerability/RLSA-2022:6590
osv	https://bugzilla.redhat.com/show_bug.cgi?id=2082643	https://osv.dev/vulnerability/RLSA-2022:6590
osv	https://bugzilla.redhat.com/show_bug.cgi?id=2082644	https://osv.dev/vulnerability/RLSA-2022:6590
osv	https://bugzilla.redhat.com/show_bug.cgi?id=2082645	https://osv.dev/vulnerability/RLSA-2022:6590
osv	https://bugzilla.redhat.com/show_bug.cgi?id=2082646	https://osv.dev/vulnerability/RLSA-2022:6590
osv	https://bugzilla.redhat.com/show_bug.cgi?id=2082647	https://osv.dev/vulnerability/RLSA-2022:6590
osv	https://bugzilla.redhat.com/show_bug.cgi?id=2082648	https://osv.dev/vulnerability/RLSA-2022:6590
osv	https://bugzilla.redhat.com/show_bug.cgi?id=2082649	https://osv.dev/vulnerability/RLSA-2022:6590
osv	https://bugzilla.redhat.com/show_bug.cgi?id=2082650	https://osv.dev/vulnerability/RLSA-2022:6590
osv	https://bugzilla.redhat.com/show_bug.cgi?id=2082651	https://osv.dev/vulnerability/RLSA-2022:6590
osv	https://bugzilla.redhat.com/show_bug.cgi?id=2082652	https://osv.dev/vulnerability/RLSA-2022:6590
osv	https://bugzilla.redhat.com/show_bug.cgi?id=2082653	https://osv.dev/vulnerability/RLSA-2022:6590
osv	https://bugzilla.redhat.com/show_bug.cgi?id=2082654	https://osv.dev/vulnerability/RLSA-2022:6590
osv	https://bugzilla.redhat.com/show_bug.cgi?id=2082655	https://osv.dev/vulnerability/RLSA-2022:6590
osv	https://bugzilla.redhat.com/show_bug.cgi?id=2082656	https://osv.dev/vulnerability/RLSA-2022:6590
osv	https://bugzilla.redhat.com/show_bug.cgi?id=2082657	https://osv.dev/vulnerability/RLSA-2022:6590
osv	https://bugzilla.redhat.com/show_bug.cgi?id=2082658	https://osv.dev/vulnerability/RLSA-2022:6590
osv	https://bugzilla.redhat.com/show_bug.cgi?id=2082659	https://osv.dev/vulnerability/RLSA-2022:6590
osv	https://bugzilla.redhat.com/show_bug.cgi?id=2115282	https://osv.dev/vulnerability/RLSA-2022:6590
osv	https://bugzilla.redhat.com/show_bug.cgi?id=2115283	https://osv.dev/vulnerability/RLSA-2022:6590
osv	https://bugzilla.redhat.com/show_bug.cgi?id=2115284	https://osv.dev/vulnerability/RLSA-2022:6590
osv	https://bugzilla.redhat.com/show_bug.cgi?id=2115285	https://osv.dev/vulnerability/RLSA-2022:6590
osv	https://bugzilla.redhat.com/show_bug.cgi?id=2115286	https://osv.dev/vulnerability/RLSA-2022:6590
osv	https://bugzilla.redhat.com/show_bug.cgi?id=2115287	https://osv.dev/vulnerability/RLSA-2022:6590
osv	https://bugzilla.redhat.com/show_bug.cgi?id=2115288	https://osv.dev/vulnerability/RLSA-2022:6590
osv	https://bugzilla.redhat.com/show_bug.cgi?id=2115289	https://osv.dev/vulnerability/RLSA-2022:6590
osv	https://bugzilla.redhat.com/show_bug.cgi?id=2115290	https://osv.dev/vulnerability/RLSA-2022:6590
osv	https://bugzilla.redhat.com/show_bug.cgi?id=2115291	https://osv.dev/vulnerability/RLSA-2022:6590
osv	https://bugzilla.redhat.com/show_bug.cgi?id=2115292	https://osv.dev/vulnerability/RLSA-2022:6590
osv	https://bugzilla.redhat.com/show_bug.cgi?id=2115293	https://osv.dev/vulnerability/RLSA-2022:6590
osv	https://bugzilla.redhat.com/show_bug.cgi?id=2115294	https://osv.dev/vulnerability/RLSA-2022:6590
osv	https://bugzilla.redhat.com/show_bug.cgi?id=2115295	https://osv.dev/vulnerability/RLSA-2022:6590
osv	https://bugzilla.redhat.com/show_bug.cgi?id=2115296	https://osv.dev/vulnerability/RLSA-2022:6590
osv	https://bugzilla.redhat.com/show_bug.cgi?id=2115297	https://osv.dev/vulnerability/RLSA-2022:6590
osv	https://bugzilla.redhat.com/show_bug.cgi?id=2115298	https://osv.dev/vulnerability/RLSA-2022:6590
osv	https://bugzilla.redhat.com/show_bug.cgi?id=2115299	https://osv.dev/vulnerability/RLSA-2022:6590
osv	https://bugzilla.redhat.com/show_bug.cgi?id=2115300	https://osv.dev/vulnerability/RLSA-2022:6590
osv	https://bugzilla.redhat.com/show_bug.cgi?id=2115301	https://osv.dev/vulnerability/RLSA-2022:6590
osv	https://bugzilla.redhat.com/show_bug.cgi?id=2122589	https://osv.dev/vulnerability/RLSA-2022:6590
osv	https://bugzilla.redhat.com/show_bug.cgi?id=2122592	https://osv.dev/vulnerability/RLSA-2022:6590
nvd	https://www.oracle.com/security-alerts/cpujul2022.html
nvd	https://security.netapp.com/advisory/ntap-20220729-0004/
nvd	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZI4Q7XW5QLUTOACRHBIEYZ6SZB6TIEMT/
nvd	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3CESCYUGY6H6O2R2GPUJLBTYSMY2PHCD/
redhat	https://access.redhat.com/security/cve/CVE-2022-21525
amazon_linux	https://alas.aws.amazon.com/cve/html/CVE-2022-2257.html	https://alas.aws.amazon.com/ALAS-2022-1639.html
amazon_linux	https://alas.aws.amazon.com/cve/html/CVE-2022-2264.html	https://alas.aws.amazon.com/ALAS-2022-1639.html
amazon_linux	https://alas.aws.amazon.com/cve/html/CVE-2022-2284.html	https://alas.aws.amazon.com/ALAS-2022-1639.html
amazon_linux	https://alas.aws.amazon.com/cve/html/CVE-2022-2285.html	https://alas.aws.amazon.com/ALAS-2022-1639.html
amazon_linux	https://alas.aws.amazon.com/cve/html/CVE-2022-2286.html	https://alas.aws.amazon.com/ALAS-2022-1639.html
amazon_linux	https://alas.aws.amazon.com/cve/html/CVE-2022-2287.html	https://alas.aws.amazon.com/ALAS-2022-1639.html
amazon_linux	https://alas.aws.amazon.com/cve/html/CVE-2022-2288.html	https://alas.aws.amazon.com/ALAS-2022-1639.html
amazon_linux	https://alas.aws.amazon.com/cve/html/CVE-2022-2289.html	https://alas.aws.amazon.com/ALAS-2022-1639.html
amazon_linux	https://alas.aws.amazon.com/cve/html/CVE-2022-2304.html	https://alas.aws.amazon.com/ALAS-2022-1639.html
amazon_linux	https://alas.aws.amazon.com/cve/html/CVE-2022-2343.html	https://alas.aws.amazon.com/ALAS-2022-1639.html
amazon_linux	https://alas.aws.amazon.com/cve/html/CVE-2022-2344.html	https://alas.aws.amazon.com/ALAS-2022-1639.html
amazon_linux	https://alas.aws.amazon.com/cve/html/CVE-2022-2345.html	https://alas.aws.amazon.com/ALAS-2022-1639.html
amazon_linux	https://alas.aws.amazon.com/cve/html/CVE-2022-2816.html	https://alas.aws.amazon.com/ALAS-2022-1639.html
amazon_linux	https://alas.aws.amazon.com/cve/html/CVE-2022-2817.html	https://alas.aws.amazon.com/ALAS-2022-1639.html
amazon_linux	https://alas.aws.amazon.com/cve/html/CVE-2022-2819.html	https://alas.aws.amazon.com/ALAS-2022-1639.html
amazon_linux	https://alas.aws.amazon.com/cve/html/CVE-2022-3037.html	https://alas.aws.amazon.com/ALAS-2022-1639.html
oracle		https://www.oracle.com/security-alerts/cpujul2022.html
redhat_bugzilla	https://www.oracle.com/security-alerts/cpujul2022.html#AppendixMSQL
redhat_bugzilla	https://bugzilla.redhat.com/show_bug.cgi?id=2115287
ubuntu	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21525
ubuntu	https://www.oracle.com/security-alerts/cpujul2022.html
ubuntu	https://ubuntu.com/security/notices/USN-5537-1
ubuntu	https://nvd.nist.gov/vuln/detail/CVE-2022-21525
ubuntu	https://launchpad.net/bugs/cve/CVE-2022-21525
ubuntu	https://security-tracker.debian.org/tracker/CVE-2022-21525
debian	https://security-tracker.debian.org/tracker/CVE-2022-21525

漏洞分析指导链接：
https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
漏洞数据来源:
其它
漏洞补丁信息：

详情(点击展开)

影响的包	修复版本	修复补丁	问题引入补丁	来源
		https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3CESCYUGY6H6O2R2GPUJLBTYSMY2PHCD/		nvd
		https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZI4Q7XW5QLUTOACRHBIEYZ6SZB6TIEMT/		nvd
		https://security.netapp.com/advisory/ntap-20220729-0004/		nvd
		https://www.oracle.com/security-alerts/cpujul2022.html		nvd

二、漏洞分析结构反馈
影响性分析说明：
当前版本受影响，在8.0.35版本修复
openEuler评分：
4.9
Vector：CVSS：3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
受影响版本排查(受影响/不受影响)：
1.openEuler-20.03-LTS-SP4(8.0.28):受影响
2.openEuler-22.03-LTS-SP1(8.0.37):受影响
3.openEuler-22.03-LTS-SP3(8.0.37):受影响
4.master(8.0.27):不受影响
5.openEuler-24.03-LTS(8.0.35):不受影响
6.openEuler-24.03-LTS-Next(8.0.37):不受影响
7.openEuler-22.03-LTS-SP4(8.0.37):不受影响

修复是否涉及abi变化(是/否)：
1.master(8.0.27):否
2.openEuler-20.03-LTS-SP4(8.0.28):否
3.openEuler-22.03-LTS-SP1(8.0.37):否
4.openEuler-22.03-LTS-SP3(8.0.37):否
5.openEuler-24.03-LTS(8.0.35):否
6.openEuler-24.03-LTS-Next(8.0.37):否
7.openEuler-22.03-LTS-SP4(8.0.37):否

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2024-2071

参考网址	关联pr	状态	补丁链接
https://ubuntu.com/security/CVE-2022-21525
https://nvd.nist.gov/vuln/detail/CVE-2022-21525
https://security-tracker.debian.org/tracker/CVE-2022-21525
https://bugzilla.suse.com/show_bug.cgi?id=CVE-2022-21525

说明：抱歉，当前工具暂未找到推荐补丁，请人工查找或者之后评论'/find-patch'尝试再次查找。
若人工查找到补丁，烦请在此issue下评论 '/report-patch 参考网址补丁链接1,补丁链接2' 便于我们不断优化工具，不胜感激。
如 /report-patch https://security-tracker.debian.org/tracker/CVE-2021-3997 https://github.com/systemd/systemd/commit/5b1cf7a9be37e20133c0208005274ce4a5b5c6a1

该漏洞影响的是8.0.29及之前版本，需要升级到8.0.29版本以上解决，目前8.0.30暂未发布，待发布后升级解决，暂时挂起；详情：https://dev.mysql.com/doc/relnotes/mysql/8.0/en/

影响性分析说明：
当前版本受影响，在8.0.35版本修复

受影响版本排查(受影响/不受影响)：
1.openEuler-20.03-LTS-SP1(8.0.28): 受影响
2.openEuler-20.03-LTS-SP3(8.0.28): 受影响
3.openEuler-20.03-LTS-SP4(8.0.28): 受影响
4.openEuler-22.03-LTS(8.0.28): 受影响
5.openEuler-22.03-LTS-SP1(8.0.29): 受影响
6.openEuler-22.03-LTS-SP2(8.0.29): 受影响
7.openEuler-22.03-LTS-SP3(8.0.29)：受影响

修复是否涉及abi变化(是/否)：
1.openEuler-20.03-LTS-SP1(8.0.28): 是
2.openEuler-20.03-LTS-SP3(8.0.28): 是
3.openEuler-20.03-LTS-SP4: 是
4.openEuler-22.03-LTS(8.0.28): 是
5.openEuler-22.03-LTS-SP1(8.0.29): 是
6.openEuler-22.03-LTS-SP2(8.0.29): 是
7.openEuler-22.03-LTS-SP3(8.0.29)：是

已通过安全委员会评审，挂起此Issue

受影响版本排查(受影响/不受影响)：
1.master:不受影响
2.openEuler-20.03-LTS-SP4:受影响
3.openEuler-22.03-LTS-SP1:受影响
4.openEuler-22.03-LTS-SP3:受影响
5.openEuler-24.03-LTS:不受影响
6.openEuler-24.03-LTS-Next:不受影响
7.openEuler-22.03-LTS-SP4:不受影响

修复是否涉及abi变化(是/否)：
1.master:否
2.openEuler-20.03-LTS-SP4:否
3.openEuler-22.03-LTS-SP1:否
4.openEuler-22.03-LTS-SP3:否
5.openEuler-24.03-LTS:否
6.openEuler-24.03-LTS-Next:否
7.openEuler-22.03-LTS-SP4:否

src-openEuler/mysql

Content Risk Flag

Comments (12)

src-openEuler/mysql .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2022-21525

Comments (12)

Search

src-openEuler/mysql