SB2022072052 - Multiple vulnerabilities in MySQL Cluster
Published: July 20, 2022 Updated: July 28, 2022
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 secuirty vulnerabilities.
1) Improper input validation (CVE-ID: CVE-2022-21519)
The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper input validation within the Cluster: General component in MySQL Cluster. A remote non-authenticated attacker can exploit this vulnerability to perform a denial of service (DoS) attack.
2) Integer underflow (CVE-ID: CVE-2022-21550)
The vulnerability allows a remote user to execute arbitrary code on the target system.
The vulnerability exists due to integer underflow when processing Data Node jobs. A remote user can send a specially crafted input to the affected application, trigger integer an underflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
3) Prototype pollution (CVE-ID: CVE-2022-21824)
The vulnerability allows a remote attacker to perform a denial of service attack.
The vulnerability exists due to the formatting logic of the console.table() function. A remote attacker can send a specially crafted request and assign an empty string to numerical keys of the object prototype.
Remediation
Install update from vendor's website.