CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
AI Score
Confidence
Low
EPSS
Percentile
74.1%
The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-0894 advisory.
mecab mecab-ipadic mysql [8.0.36-1]
- Update to MySQL 8.0.36
[8.0.35-2]
- Fix int-conversion type error in memcached
[8.0.35-1]
- Update to MySQL 8.0.35
- Remove patches now upstream
[8.0.34-1]
- Update to MySQL 8.0.34
- Add patch from upstream bug#110569
- Add patch to fix binlog format issue
- Use --skip-combinations over --binlog-format=mixed
- Add alignment patch upstream bug#110752
[8.0.33-1]
- Update to MySQL 8.0.33
Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application’s self-reported version number.
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Oracle Linux Security Advisory ELSA-2024-0894.
##
include('compat.inc');
if (description)
{
script_id(190885);
script_version("1.2");
script_set_attribute(attribute:"plugin_modification_date", value:"2024/09/21");
script_cve_id(
"CVE-2022-4899",
"CVE-2023-21911",
"CVE-2023-21919",
"CVE-2023-21920",
"CVE-2023-21929",
"CVE-2023-21933",
"CVE-2023-21935",
"CVE-2023-21940",
"CVE-2023-21945",
"CVE-2023-21946",
"CVE-2023-21947",
"CVE-2023-21953",
"CVE-2023-21955",
"CVE-2023-21962",
"CVE-2023-21966",
"CVE-2023-21972",
"CVE-2023-21976",
"CVE-2023-21977",
"CVE-2023-21980",
"CVE-2023-21982",
"CVE-2023-22005",
"CVE-2023-22007",
"CVE-2023-22008",
"CVE-2023-22032",
"CVE-2023-22033",
"CVE-2023-22038",
"CVE-2023-22046",
"CVE-2023-22048",
"CVE-2023-22053",
"CVE-2023-22054",
"CVE-2023-22056",
"CVE-2023-22057",
"CVE-2023-22058",
"CVE-2023-22059",
"CVE-2023-22064",
"CVE-2023-22065",
"CVE-2023-22066",
"CVE-2023-22068",
"CVE-2023-22070",
"CVE-2023-22078",
"CVE-2023-22079",
"CVE-2023-22084",
"CVE-2023-22092",
"CVE-2023-22097",
"CVE-2023-22103",
"CVE-2023-22104",
"CVE-2023-22110",
"CVE-2023-22111",
"CVE-2023-22112",
"CVE-2023-22113",
"CVE-2023-22114",
"CVE-2023-22115",
"CVE-2024-20960",
"CVE-2024-20961",
"CVE-2024-20962",
"CVE-2024-20963",
"CVE-2024-20964",
"CVE-2024-20965",
"CVE-2024-20966",
"CVE-2024-20967",
"CVE-2024-20968",
"CVE-2024-20969",
"CVE-2024-20970",
"CVE-2024-20971",
"CVE-2024-20972",
"CVE-2024-20973",
"CVE-2024-20974",
"CVE-2024-20976",
"CVE-2024-20977",
"CVE-2024-20978",
"CVE-2024-20981",
"CVE-2024-20982",
"CVE-2024-20983",
"CVE-2024-20984",
"CVE-2024-20985"
);
script_xref(name:"IAVA", value:"2023-A-0212-S");
script_xref(name:"IAVA", value:"2023-A-0368-S");
script_xref(name:"IAVA", value:"2023-A-0562");
script_xref(name:"IAVA", value:"2024-A-0034-S");
script_name(english:"Oracle Linux 8 : mysql:8.0 (ELSA-2024-0894)");
script_set_attribute(attribute:"synopsis", value:
"The remote Oracle Linux host is missing one or more security updates.");
script_set_attribute(attribute:"description", value:
"The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the
ELSA-2024-0894 advisory.
mecab
mecab-ipadic
mysql
[8.0.36-1]
- Update to MySQL 8.0.36
[8.0.35-2]
- Fix int-conversion type error in memcached
[8.0.35-1]
- Update to MySQL 8.0.35
- Remove patches now upstream
[8.0.34-1]
- Update to MySQL 8.0.34
- Add patch from upstream bug#110569
- Add patch to fix binlog format issue
- Use --skip-combinations over --binlog-format=mixed
- Add alignment patch upstream bug#110752
[8.0.33-1]
- Update to MySQL 8.0.33
Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
script_set_attribute(attribute:"see_also", value:"https://linux.oracle.com/errata/ELSA-2024-0894.html");
script_set_attribute(attribute:"solution", value:
"Update the affected packages.");
script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:S/C:C/I:C/A:C");
script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H");
script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
script_set_attribute(attribute:"cvss_score_source", value:"CVE-2023-21980");
script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
script_set_attribute(attribute:"exploit_available", value:"false");
script_set_attribute(attribute:"vuln_publication_date", value:"2023/03/31");
script_set_attribute(attribute:"patch_publication_date", value:"2024/02/21");
script_set_attribute(attribute:"plugin_publication_date", value:"2024/02/22");
script_set_attribute(attribute:"plugin_type", value:"local");
script_set_attribute(attribute:"cpe", value:"cpe:/a:oracle:linux:8:10:appstream_base");
script_set_attribute(attribute:"cpe", value:"cpe:/a:oracle:linux:8::appstream");
script_set_attribute(attribute:"cpe", value:"cpe:/o:oracle:linux:8");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:mecab");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:mecab-devel");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:mecab-ipadic");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:mecab-ipadic-EUCJP");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:mysql");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:mysql-common");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:mysql-devel");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:mysql-errmsg");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:mysql-libs");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:mysql-server");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:mysql-test");
script_set_attribute(attribute:"generated_plugin", value:"current");
script_set_attribute(attribute:"stig_severity", value:"I");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_family(english:"Oracle Linux Local Security Checks");
script_copyright(english:"This script is Copyright (C) 2024 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_dependencies("ssh_get_info.nasl");
script_require_keys("Host/OracleLinux", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/local_checks_enabled");
exit(0);
}
include('rpm.inc');
if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item('Host/OracleLinux')) audit(AUDIT_OS_NOT, 'Oracle Linux');
var os_release = get_kb_item("Host/RedHat/release");
if (isnull(os_release) || !pregmatch(pattern: "Oracle (?:Linux Server|Enterprise Linux)", string:os_release)) audit(AUDIT_OS_NOT, 'Oracle Linux');
var os_ver = pregmatch(pattern: "Oracle (?:Linux Server|Enterprise Linux) .*release ([0-9]+(\.[0-9]+)?)", string:os_release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Oracle Linux');
os_ver = os_ver[1];
if (! preg(pattern:"^8([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, 'Oracle Linux 8', 'Oracle Linux ' + os_ver);
if (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);
var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Oracle Linux', cpu);
var module_ver = get_kb_item('Host/RedHat/appstream/mysql');
if (isnull(module_ver)) audit(AUDIT_PACKAGE_NOT_INSTALLED, 'Module mysql:8.0');
if ('8.0' >!< module_ver) audit(AUDIT_PACKAGE_NOT_AFFECTED, 'Module mysql:' + module_ver);
var appstreams = {
'mysql:8.0': [
{'reference':'mecab-0.996-2.module+el8.9.0+90153+70413b10', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},
{'reference':'mecab-devel-0.996-2.module+el8.9.0+90153+70413b10', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},
{'reference':'mecab-ipadic-2.7.0.20070801-16.0.1.module+el8.9.0+90153+70413b10', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},
{'reference':'mecab-ipadic-EUCJP-2.7.0.20070801-16.0.1.module+el8.9.0+90153+70413b10', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},
{'reference':'mysql-8.0.36-1.module+el8.9.0+90153+70413b10', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},
{'reference':'mysql-common-8.0.36-1.module+el8.9.0+90153+70413b10', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},
{'reference':'mysql-devel-8.0.36-1.module+el8.9.0+90153+70413b10', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},
{'reference':'mysql-errmsg-8.0.36-1.module+el8.9.0+90153+70413b10', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},
{'reference':'mysql-libs-8.0.36-1.module+el8.9.0+90153+70413b10', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},
{'reference':'mysql-server-8.0.36-1.module+el8.9.0+90153+70413b10', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},
{'reference':'mysql-test-8.0.36-1.module+el8.9.0+90153+70413b10', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},
{'reference':'mecab-0.996-2.module+el8.9.0+90153+70413b10', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},
{'reference':'mecab-devel-0.996-2.module+el8.9.0+90153+70413b10', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},
{'reference':'mecab-ipadic-2.7.0.20070801-16.0.1.module+el8.9.0+90153+70413b10', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},
{'reference':'mecab-ipadic-EUCJP-2.7.0.20070801-16.0.1.module+el8.9.0+90153+70413b10', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},
{'reference':'mysql-8.0.36-1.module+el8.9.0+90153+70413b10', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},
{'reference':'mysql-common-8.0.36-1.module+el8.9.0+90153+70413b10', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},
{'reference':'mysql-devel-8.0.36-1.module+el8.9.0+90153+70413b10', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},
{'reference':'mysql-errmsg-8.0.36-1.module+el8.9.0+90153+70413b10', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},
{'reference':'mysql-libs-8.0.36-1.module+el8.9.0+90153+70413b10', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},
{'reference':'mysql-server-8.0.36-1.module+el8.9.0+90153+70413b10', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},
{'reference':'mysql-test-8.0.36-1.module+el8.9.0+90153+70413b10', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE}
]
};
var flag = 0;
var appstreams_found = 0;
foreach var module (keys(appstreams)) {
var appstream = NULL;
var appstream_name = NULL;
var appstream_version = NULL;
var appstream_split = split(module, sep:':', keep:FALSE);
if (!empty_or_null(appstream_split)) {
appstream_name = appstream_split[0];
appstream_version = appstream_split[1];
if (!empty_or_null(appstream_name)) appstream = get_one_kb_item('Host/RedHat/appstream/' + appstream_name);
}
if (!empty_or_null(appstream) && appstream_version == appstream || appstream_name == 'all') {
appstreams_found++;
foreach var package_array ( appstreams[module] ) {
var reference = NULL;
var _release = NULL;
var sp = NULL;
var _cpu = NULL;
var el_string = NULL;
var rpm_spec_vers_cmp = NULL;
var epoch = NULL;
var allowmaj = NULL;
if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
if (!empty_or_null(package_array['release'])) _release = 'EL' + package_array['release'];
if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];
if (!empty_or_null(package_array['cpu'])) _cpu = package_array['cpu'];
if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];
if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];
if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];
if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];
if (reference && _release) {
if (rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;
}
}
}
}
if (!appstreams_found) audit(AUDIT_PACKAGE_NOT_INSTALLED, 'Module mysql:8.0');
if (flag)
{
security_report_v4(
port : 0,
severity : SECURITY_HOLE,
extra : rpm_report_get()
);
exit(0);
}
else
{
var tested = pkg_tests_get();
if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'mecab / mecab-devel / mecab-ipadic / etc');
}
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-4899
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21911
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21919
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21920
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21929
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21933
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21935
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21940
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21945
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21946
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21947
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21953
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21955
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21962
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21966
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21972
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21976
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21977
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21980
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21982
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22005
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22007
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22008
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22032
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22033
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22038
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22046
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22048
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22053
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22054
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22056
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22057
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22058
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22059
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22064
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22065
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22066
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22068
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22070
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22078
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22079
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22084
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22092
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22097
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22103
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22104
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22110
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22111
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22112
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22113
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22114
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22115
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20960
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20961
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20962
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20963
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20964
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20965
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20966
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20967
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20968
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20969
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20970
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20971
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20972
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20973
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20974
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20976
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20977
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20978
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20981
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20982
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20983
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20984
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20985
linux.oracle.com/errata/ELSA-2024-0894.html
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
AI Score
Confidence
Low
EPSS
Percentile
74.1%