CVE-2021-2009 — NULL Pointer Dereference in Oracle Mysql

CWE-476 — NULL Pointer DereferenceCWE-460 — Improper Cleanup on Thrown ExceptionCWE-456 — Missing Initialization of a VariableCWE-191 — Integer Underflow (Wrap or Wraparound)CWE-590 — Free of Memory not on the HeapCWE-416 — Use After FreeCWE-835 — Infinite Loop19 documents9 sources
Severity
4.9MEDIUMNVD
EPSS
0.2%
top 57.94%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Oracle MysqlOracle Corporation Mysql ServerFedoraproject Fedora
Timeline
PublishedJan 20
Latest updateJun 20

Description

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Roles). Supported versions that are affected are 8.0.19 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS V…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:HExploitability: 1.2 | Impact: 3.6

Affected Packages2 packages

▶CVEListV5oracle_corporation/mysql_server8.0.19 and prior
▶NVDoracle/mysql8.0.0 — 8.0.19

Also affects: Fedora 32, 33

🔴Vulnerability Details

3
GHSA
GHSA-j2g8-rpv4-4pqf: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Roles)↗2022-05-24
▶
OSV
CVE-2021-2009: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Roles)↗2021-01-20
▶
CVEList
CVE-2021-2009: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Roles)↗2021-01-20
▶

💥Exploits & PoCs

3
Exploit-DB
VUPlayer 2.49 - '.wax' Local Buffer Overflow (DEP Bypass)↗2022-01-10
▶
Exploit-DB
Adobe ColdFusion 8 - Remote Command Execution (RCE)↗2021-06-24
▶
Exploit-DB
Virtue Classifieds - 'category' SQL Injection↗2009-06-08
▶

📋Vendor Advisories

7
Red Hat
kernel: PCI: pciehp: Fix infinite loop in IRQ handler upon power fault↗2024-06-20
▶
Red Hat
kernel: x86/hyperv: Fix NULL deref in set_hv_tscchange_cb() if Hyper-V setup fails↗2024-04-10
▶
Red Hat
kernel: btrfs: do not BUG_ON in link_to_fixup_dir↗2024-03-25
▶
Red Hat
kernel: tpm: efi: Use local variable for calculating final log size↗2024-02-27
▶
Red Hat
mysql: Server: Security: Roles unspecified vulnerability (CPU Jan 2021)↗2021-01-19
▶
CVE-2021-2009 — NULL Pointer Dereference in Oracle | cvebase