Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
ibmIBMA161D5EBF082D45C00B04F43A967E2FA7D8BC1F452302F05F94A0428ECCE23E7
HistoryOct 23, 2024 - 9:04 p.m.

Security Bulletin: IBM Security Guardium is affected by vulnerabilities in Oracle MySQL

2024-10-2321:04:00
www.ibm.com
7
ibm security guardium
oracle mysql server
vulnerabilities
high availability impact
unspecified vulnerability

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

AI Score

6.4

Confidence

High

JSON

Summary

IBM Security Guardium has addressed these vulnerabilities in an update.

Vulnerability Details

**CVEID:**CVE-2024-21137 **DESCRIPTION:**An unspecified vulnerability in Oracle MySQL Server related to the Server: Optimizer component could allow a remote authenticated attacker to cause high availability impact. **CWE:**CWE-770: Allocation of Resources Without Limits or Throttling **CVSS Source:**IBM X-Force **CVSS Base score:**4.9 CVSS Vector:(CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)

**CVEID:**CVE-2024-21165 **DESCRIPTION:**An unspecified vulnerability in Oracle MySQL Server related to the Server: Pluggable Auth component could allow a remote authenticated attacker to cause high availability impact. **CWE:**CWE-770: Allocation of Resources Without Limits or Throttling **CVSS Source:**IBM X-Force **CVSS Base score:**4.9 CVSS Vector:(CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)

**CVEID:**CVE-2024-21125 **DESCRIPTION:**An unspecified vulnerability in Oracle MySQL Server related to the Server: FTS component could allow a remote authenticated attacker to cause high availability impact. **CWE:**CWE-770: Allocation of Resources Without Limits or Throttling **CVSS Source:**IBM X-Force **CVSS Base score:**4.9 CVSS Vector:(CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)

**CVEID:**CVE-2024-21134 **DESCRIPTION:**An unspecified vulnerability in Oracle MySQL Server related to the Server: Connection Handling component could allow a remote authenticated attacker to cause low availability impact. **CWE:**CWE-770: Allocation of Resources Without Limits or Throttling **CVSS Source:**IBM X-Force **CVSS Base score:**4.3 CVSS Vector:(CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)

**CVEID:**CVE-2024-21163 **DESCRIPTION:**An unspecified vulnerability in Oracle MySQL Server related to the Server: Optimizer component could allow a remote authenticated attacker to cause high availability impact. **CWE:**CWE-770: Allocation of Resources Without Limits or Throttling **CVSS Source:**IBM X-Force **CVSS Base score:**5.5 CVSS Vector:(CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H)

**CVEID:**CVE-2024-21177 **DESCRIPTION:**An unspecified vulnerability in Oracle MySQL Server related to the Cluster: General component could allow a remote authenticated attacker to cause high availability impact. **CWE:**CWE-770: Allocation of Resources Without Limits or Throttling **CVSS Source:**IBM X-Force **CVSS Base score:**6.5 CVSS Vector:(CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

**CVEID:**CVE-2024-21171 **DESCRIPTION:**An unspecified vulnerability in Oracle MySQL Server related to the Server: Optimizer component could allow a remote authenticated attacker to cause high availability impact. **CWE:**CWE-770: Allocation of Resources Without Limits or Throttling **CVSS Source:**IBM X-Force **CVSS Base score:**6.5 CVSS Vector:(CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

**CVEID:**CVE-2024-21135 **DESCRIPTION:**An unspecified vulnerability in Oracle MySQL Server related to the Server: Optimizer component could allow a remote authenticated attacker to cause high availability impact. **CWE:**CWE-770: Allocation of Resources Without Limits or Throttling **CVSS Source:**IBM X-Force **CVSS Base score:**4.9 CVSS Vector:(CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)

**CVEID:**CVE-2024-21160 **DESCRIPTION:**An unspecified vulnerability in Oracle MySQL Server related to the InnoDB component could allow a remote authenticated attacker to cause high availability impact. **CWE:**CWE-770: Allocation of Resources Without Limits or Throttling **CVSS Source:**IBM X-Force **CVSS Base score:**4.9 CVSS Vector:(CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)

**CVEID:**CVE-2024-20996 **DESCRIPTION:**An unspecified vulnerability in Oracle MySQL Server related to the InnoDB component could allow a remote authenticated attacker to cause high availability impact. **CWE:**CWE-770: Allocation of Resources Without Limits or Throttling **CVSS Source:**IBM X-Force **CVSS Base score:**4.9 CVSS Vector:(CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)

**CVEID:**CVE-2024-21127 **DESCRIPTION:**An unspecified vulnerability in Oracle MySQL Server related to the Server: DDL component could allow a remote authenticated attacker to cause high availability impact. **CWE:**CWE-770: Allocation of Resources Without Limits or Throttling **CVSS Source:**IBM X-Force **CVSS Base score:**4.9 CVSS Vector:(CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)

**CVEID:**CVE-2024-21179 **DESCRIPTION:**An unspecified vulnerability in Oracle MySQL Server related to the InnoDB component could allow a remote authenticated attacker to cause high availability impact. **CWE:**CWE-770: Allocation of Resources Without Limits or Throttling **CVSS Source:**IBM X-Force **CVSS Base score:**4.9 CVSS Vector:(CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)

**CVEID:**CVE-2024-21162 **DESCRIPTION:**An unspecified vulnerability in Oracle MySQL Server related to the Server: Optimizer component could allow a remote authenticated attacker to cause high availability impact. **CWE:**CWE-770: Allocation of Resources Without Limits or Throttling **CVSS Source:**IBM X-Force **CVSS Base score:**4.9 CVSS Vector:(CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)

**CVEID:**CVE-2024-21185 **DESCRIPTION:**An unspecified vulnerability in Oracle MySQL Server related to the InnoDB component could allow a remote authenticated attacker to cause high availability impact. **CWE:**CWE-770: Allocation of Resources Without Limits or Throttling **CVSS Source:**IBM X-Force **CVSS Base score:**4.9 CVSS Vector:(CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)

**CVEID:**CVE-2024-21130 **DESCRIPTION:**An unspecified vulnerability in Oracle MySQL Server related to the Server: Optimizer component could allow a remote authenticated attacker to cause high availability impact. **CWE:**CWE-770: Allocation of Resources Without Limits or Throttling **CVSS Source:**IBM X-Force **CVSS Base score:**4.9 CVSS Vector:(CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)

**CVEID:**CVE-2024-21159 **DESCRIPTION:**An unspecified vulnerability in Oracle MySQL Server related to the InnoDB component could allow a remote authenticated attacker to cause high availability impact. **CWE:**CWE-770: Allocation of Resources Without Limits or Throttling **CVSS Source:**IBM X-Force **CVSS Base score:**4.9 CVSS Vector:(CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)

**CVEID:**CVE-2024-21170 **DESCRIPTION:**An unspecified vulnerability in Oracle MySQL Connectors related to the Connector/Python component could allow a remote authenticated attacker to cause low confidentiality, integrity and availability impact. **CWE:**CWE-770: Allocation of Resources Without Limits or Throttling **CVSS Source:**IBM X-Force **CVSS Base score:**6.3 CVSS Vector:(CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L)

**CVEID:**CVE-2024-21142 **DESCRIPTION:**An unspecified vulnerability in Oracle MySQL Server related to the Server: Security: Privileges component could allow a remote authenticated attacker to cause high availability impact. **CWE:**CWE-770: Allocation of Resources Without Limits or Throttling **CVSS Source:**IBM X-Force **CVSS Base score:**4.9 CVSS Vector:(CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)

**CVEID:**CVE-2024-21166 **DESCRIPTION:**An unspecified vulnerability in Oracle MySQL Server related to the InnoDB component could allow a remote authenticated attacker to cause high availability impact. **CWE:**CWE-770: Allocation of Resources Without Limits or Throttling **CVSS Source:**IBM X-Force **CVSS Base score:**5.9 CVSS Vector:(CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H)

**CVEID:**CVE-2024-21176 **DESCRIPTION:**An unspecified vulnerability in Oracle MySQL Server related to the Server: Thread Pooling component could allow a remote authenticated attacker to cause high availability impact. **CWE:**CWE-770: Allocation of Resources Without Limits or Throttling **CVSS Source:**IBM X-Force **CVSS Base score:**5.3 CVSS Vector:(CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)

**CVEID:**CVE-2024-21157 **DESCRIPTION:**An unspecified vulnerability in Oracle MySQL Server related to the InnoDB component could allow a remote authenticated attacker to cause high availability impact. **CWE:**CWE-770: Allocation of Resources Without Limits or Throttling **CVSS Source:**IBM X-Force **CVSS Base score:**4.9 CVSS Vector:(CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)

**CVEID:**CVE-2024-21173 **DESCRIPTION:**An unspecified vulnerability in Oracle MySQL Server related to the InnoDB component could allow a remote authenticated attacker to cause high availability impact. **CWE:**CWE-770: Allocation of Resources Without Limits or Throttling **CVSS Source:**IBM X-Force **CVSS Base score:**4.9 CVSS Vector:(CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)

**CVEID:**CVE-2024-21129 **DESCRIPTION:**An unspecified vulnerability in Oracle MySQL Server related to the Server: DDL component could allow a remote authenticated attacker to cause high availability impact. **CWE:**CWE-770: Allocation of Resources Without Limits or Throttling **CVSS Source:**IBM X-Force **CVSS Base score:**4.9 CVSS Vector:(CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

Affected Product(s) Version(s)
IBM Security Guardium 12.0

Remediation/Fixes

IBM strongly encourages customers to update their systems promptly.

Product Version Fix
IBM Security Guardium 12.0 https://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM Security&product=ibm/Information+Management/InfoSphere+Guardium&release=12.0&platform=Linux&function=fixId&fixids=SqlGuard_12.0p25_Bundle_Oct-10-2024&includeSupersedes=0&source=fc

Workarounds and Mitigations

None

Affected configurations

Vulners
Node
ibmsecurity_guardiumMatch12.0
VendorProductVersionCPE
ibmsecurity_guardium12.0cpe:2.3:a:ibm:security_guardium:12.0:*:*:*:*:*:*:*

Related

nessus 19
openvas 12
osv 42
ubuntu 1
photon 2
fedora 1
f5 7
redhatcve 14
ubuntucve 14
nvd 13
vulnrichment 12
cbl_mariner 21
cve 14
debiancve 13
cvelist 14
nessus
nessus
Photon OS 5.0: Mysql PHSA-2024-5.0-0335
2024-07-30 00:00:00
Fedora 40 : mysql8.0 (2024-5d9dc19f2d)
2024-08-21 00:00:00
Photon OS 4.0: Mysql PHSA-2024-4.0-0661
2024-08-01 00:00:00
openvas
openvas
Fedora: Security Advisory (FEDORA-2024-5d9dc19f2d)
2024-08-21 00:00:00
Ubuntu: Security Advisory (USN-6934-1)
2024-08-01 00:00:00
Oracle MySQL Server 8.x <= 8.0.37, 8.1.x <= 8.4.0 Security Update (cpujul2024) - Linux
2024-07-17 00:00:00
osv
osv
mysql-8.0 vulnerabilities
2024-07-31 10:51:55
CVE-2024-20996
2024-07-16 23:15:11
UBUNTU-CVE-2024-20996
2024-07-16 23:15:00
ubuntu
ubuntu
MySQL vulnerabilities
2024-07-31 00:00:00
photon
photon
Moderate Photon OS Security Update - PHSA-2024-5.0-0335
2024-07-26 00:00:00
Moderate Photon OS Security Update - PHSA-2024-4.0-0661
2024-07-26 00:00:00
fedora
fedora
[SECURITY] Fedora 40 Update: mysql8.0-8.0.39-1.fc40
2024-08-21 03:08:53
f5
f5
K000140399: MySQL vulnerabilities CVE-2024-21130, CVE-2024-21142, CVE-2024-21166, and CVE-2024-21185
2024-07-22 00:00:00
K000140735: Oracle MySQL vulnerabilities CVE-2024-21160, CVE-2024-21162, and CVE-2024-21173
2024-08-19 00:00:00
K000140918: MySQL vulnerabilities CVE-2024-20996 and CVE-2024-21157
2024-09-03 00:00:00
redhatcve
redhatcve
CVE-2024-20996
2024-07-17 18:24:46
CVE-2024-21135
2024-07-18 09:57:55
CVE-2024-21159
2024-07-18 12:29:58
ubuntucve
ubuntucve
CVE-2024-20996
2024-07-16 00:00:00
CVE-2024-21130
2024-07-16 00:00:00
CVE-2024-21129
2024-07-16 00:00:00
nvd
nvd
CVE-2024-20996
2024-07-16 23:15:11
CVE-2024-21134
2024-07-16 23:15:13
CVE-2024-21176
2024-07-16 23:15:21
vulnrichment
vulnrichment
CVE-2024-20996
2024-07-16 22:39:19
CVE-2024-21135
2024-07-16 22:39:55
CVE-2024-21170
2024-07-16 22:40:07
cbl_mariner
cbl_mariner
CVE-2024-20996 affecting package mysql for versions less than 8.0.40-1
2024-10-23 00:47:03
CVE-2024-20996 affecting package mysql for versions less than 8.0.40-2
2024-11-08 21:38:16
CVE-2024-21159 affecting package mysql for versions less than 8.0.40-1
2024-10-23 00:47:03
cve
cve
CVE-2024-20996
2024-07-16 23:15:11
CVE-2024-21157
2024-07-16 23:15:18
CVE-2024-21129
2024-07-16 23:15:12
debiancve
debiancve
CVE-2024-21135
2024-07-16 23:15:14
CVE-2024-20996
2024-07-16 23:15:11
CVE-2024-21159
2024-07-16 23:15:18
cvelist
cvelist
CVE-2024-21170
2024-07-16 22:40:07
CVE-2024-20996
2024-07-16 22:39:19
CVE-2024-21135
2024-07-16 22:39:55

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

AI Score

6.4

Confidence

High

JSON
Related for A161D5EBF082D45C00B04F43A967E2FA7D8BC1F452302F05F94A0428ECCE23E7
nessus19openvas12osv42ubuntu1photon2fedora1f57redhatcve14ubuntucve14nvd13vulnrichment12cbl_mariner21cve14debiancve13cvelist14