A remote code execution issue was discovered in MariaDB 10.2 before 10.2.37 10.3 before 10.3.28 10.4 before 10.4.18 and 10.5 before 10.5.9; Percona Server through 2021-03-03; and the wsrep patch through 2021-03-03 for MySQL. An untrusted search path leads to eval injection in which a database SUPER user can execute OS commands after modifying wsrep_provider and wsrep_notify_cmd. NOTE: this does not affect an Oracle product.

🗓️ 27 Mar 2021 07:00:00Reported by MicrosoftType

Remote code execution in MariaDB via untrusted search path; SUPER users can run OS commands by altering wsrep provider.

Reporter	Title	Published	Views	Family All 269
0day.today	MariaDB 10.2 /MySQL - (wsrep_provider) OS Command Execution Vulnerability	14 Apr 202100:00	–	zdt
ALT Linux	Security fix for the ALT Linux 9 package mariadb version 10.4.20-alt1	14 Jul 202100:00	–	altlinux
GithubExploit	Exploit for Out-of-bounds Write in Polkit_Project Polkit	27 Jan 202202:27	–	githubexploit
GithubExploit	Exploit for Code Injection in Mariadb	9 Dec 202111:18	–	githubexploit
GithubExploit	Exploit for Code Injection in Mariadb	14 Dec 202217:36	–	githubexploit
GithubExploit	Exploit for Code Injection in Mariadb	15 Apr 202106:40	–	githubexploit
IBM Security Bulletins	Security Bulletin: PowerVC installation on RHEL is vulnerable to MariaDB with CVE-2021-27928	18 May 202211:23	–	ibm
Tenable Nessus	Amazon Linux 2 : mariadb (ALASMARIADB10.5-2023-001)	27 Sep 202300:00	–	nessus
Tenable Nessus	Alibaba Cloud Linux 3 : 0030: mariadb:10.3 and mariadb-devel:10.3 (ALINUX3-SA-2021:0030)	14 May 202500:00	–	nessus
Tenable Nessus	AlmaLinux 8 : mariadb:10.3 and mariadb-devel:10.3 (ALSA-2021:1242)	9 Feb 202200:00	–	nessus