CVE-2022-21290
published 2022-01-19CVE-2022-21290: Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 8.0.27 and prior. Difficult…
PriorityP428medium6.3CVSS 3.1
AVAACHPRHUIRSUCHIHAH
EPSS
3.07%
86.2th percentile
Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H).
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| msrc | cbl2_mysql_8.0.28-1_on_cbl_mariner_2.0 | — | — |
| oracle | mysql | 8.0.0 – 8.0.27 | — |
| oracle_corporation | mysql_cluster | — | — |
CVSS provenance
nvdv3.16.3MEDIUMCVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
nvdv2.04.0MEDIUMAV:A/AC:H/Au:S/C:P/I:P/A:P
ghsa5.5MEDIUM
vendor_msrc6.3MEDIUM
vendor_oracle6.3MEDIUM
vendor_redhat6.2MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
netty: world readable temporary file containing sensitive data
vendor_redhat·2022-05-06·CVSS 6.2
CVE-2022-24823 [MEDIUM] CWE-379 netty: world readable temporary file containing sensitive data
netty: world readable temporary file containing sensitive data
Netty is an open-source, asynchronous event-driven network application framework. The package `io.netty:netty-codec-http` prior to version 4.1.77.Final contains an insufficient fix for CVE-2021-21290. When Netty's multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled. This only impacts applications running on Java version 6 and lower. Additionally, this vulnerability impacts code running on Unix-like systems, and very old versions of Mac OSX and Windows as they all share the system temporary directory between all users. Version 4.1.77.Final contains a patch for this vulnerability. As a workaround, specify one's own `java.i
Oracle
Oracle Oracle MySQL Risk Matrix: Cluster: General — CVE-2022-21290
vendor_oracle·2022-01-15·CVSS 6.3
CVE-2022-21290 [MEDIUM] Oracle Oracle MySQL Risk Matrix: Cluster: General — CVE-2022-21290
Oracle Oracle MySQL Risk Matrix: Cluster: General vulnerability
CVE: CVE-2022-21290
CVSS: 6.3
Protocol: Multiple
Remote exploit: No
Affected versions: Adjacent
Network
Advisory: cpujan2022 (JAN 2022)
Microsoft
Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 8.0.27 and prior. Difficult to exploit vulnerability allows high priv
vendor_msrc·2022-01-11·CVSS 6.3
CVE-2022-21290 [MEDIUM] Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 8.0.27 and prior. Difficult to exploit vulnerability allows high priv
Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H).
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerabi
GHSA
Local Information Disclosure Vulnerability in io.netty:netty-codec-http
ghsa·2022-05-10·CVSS 5.5
CVE-2022-24823 [MEDIUM] CWE-378 Local Information Disclosure Vulnerability in io.netty:netty-codec-http
Local Information Disclosure Vulnerability in io.netty:netty-codec-http
### Description ###
[GHSA-5mcr-gq6c-3hq2](https://github.com/netty/netty/security/advisories/GHSA-5mcr-gq6c-3hq2) (CVE-2021-21290) contains an insufficient fix for the vulnerability identified.
### Impact ###
When netty's multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled.
This only impacts applications running on Java version 6 and lower. Additionally, this vulnerability impacts code running on Unix-like systems, and very old versions of Mac OSX and Windows as they all share the system temporary directory between all users.
### Vulnerability Details ###
To fix the vulnerability the code was changed to the
GHSA
GHSA-g95j-qpmf-f2fq: Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General)
ghsa_unreviewed·2022-01-20
CVE-2022-21290 [MEDIUM] GHSA-g95j-qpmf-f2fq: Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General)
Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H).
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://security.netapp.com/advisory/ntap-20220121-0008/https://www.oracle.com/security-alerts/cpujan2022.htmlhttps://www.zerodayinitiative.com/advisories/ZDI-22-086/https://security.netapp.com/advisory/ntap-20220121-0008/https://www.oracle.com/security-alerts/cpujan2022.htmlhttps://www.zerodayinitiative.com/advisories/ZDI-22-086/
2022-01-19
Published