Security
Headlines
HeadlinesLatestCVEs

Headline

CVE-2022-27381: [MDEV-26061] MariaDB server crash at Field::set_default

An issue in the component Field::set_default of MariaDB Server v10.6 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL statements.

CVE
#sql#linux#dos

CREATE TEMPORARY TABLE v0 ( v2 TIMESTAMP CHECK ( DEFAULT ( v2 ) IS NOT TRUE ) , v1 TIMESTAMP ) AS SELECT DISTINCT ‘x’ AS v3 WINDOW CHECKSUM AS ( ) ;

Core was generated by `/home/supersix/fuzz/security/MariaDB/install/bin/mysqld --defaults-file=/home/s’.

Program terminated with signal SIGSEGV, Segmentation fault.

#0 __pthread_kill (threadid=<optimized out>, signo=signo@entry=0xb)

at ../sysdeps/unix/sysv/linux/pthread\_kill.c:56

[Current thread is 1 (Thread 0x7f154c17f300 (LWP 1992265))]

gdb-peda$ #0 __pthread_kill (threadid=<optimized out>, signo=signo@entry=0xb)

at ../sysdeps/unix/sysv/linux/pthread\_kill.c:56

#1 0x00005640d742e98f in my_write_core (sig=sig@entry=0xb)

at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/mysys/stacktrace.c:424

#2 0x00005640d5e9b583 in handle_fatal_signal (sig=<optimized out>)

at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/signal\_handler.cc:344

#3 <signal handler called>

#4 0x00005640d5dfe617 in Field::set_default (this=0x61d0000b9ab8)

at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/field.cc:2591

#5 0x00005640d5f553a6 in Item_default_value::calculate (this=0x6190000f5240)

at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/item.cc:9468

#6 0x00005640d5f55466 in Item_default_value::val_real (this=0x6190000f5240)

at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/item.cc:9486

#7 0x00005640d5bbf3bb in Type_handler_real_result::Item_val_bool (

this=<optimized out>, item=<optimized out>)

at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/sql\_type.cc:5080

#8 0x00005640d5fa186c in Item_func_truth::val_bool (this=0x6190000f5370)

at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/item\_cmpfunc.cc:1165

#9 Item_func_truth::val_int (this=0x6190000f5370)

at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/item\_cmpfunc.cc:1188

#10 0x00005640d5966058 in TABLE::verify_constraints (this=0x6190000f4698,

ignore\_failure=<optimized out>)

at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/table.cc:6155

#11 0x00005640d5966bbd in TABLE_LIST::view_check_option (this=0x62b000085498,

thd=<optimized out>, ignore\_failure=<optimized out>)

at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/table.cc:6128

#12 0x00005640d5476284 in select_insert::send_data (this=0x62b0000871f0,

values=...)

at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/sql\_insert.cc:4061

#13 0x00005640d576aafa in select_result_sink::send_data_with_check (

u=0x62b0000823d0, sent=0x0, items=..., this=0x62b0000871f0)

at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/sql\_class.h:5609

#14 select_result_sink::send_data_with_check (sent=0x0, u=0x62b0000823d0,

items=..., this=0x62b0000871f0)

at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/sql\_class.h:5599

#15 JOIN::exec_inner (this=0x62b000087340)

at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/sql\_select.cc:4592

#16 0x00005640d576bd20 in JOIN::exec (this=0x62b000087340)

at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/sql\_select.cc:4504

#17 0x00005640d5762338 in mysql_select (thd=0x62b00007e218,

tables=<optimized out>, fields=..., conds=<optimized out>, og\_num=0x0,

order=<optimized out>, group=0x0, having=0x0, proc\_param=0x0,

select\_options=0x20080040b01, result=0x62b0000871f0, unit=0x62b0000823d0,

select\_lex=0x62b000086138)

at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/sql\_select.cc:4982

#18 0x00005640d5764425 in handle_select (thd=thd@entry=0x62b00007e218,

lex=lex@entry=0x62b000082308, result=result@entry=0x62b0000871f0,

setup\_tables\_done\_option=setup\_tables\_done\_option@entry=0x0)

at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/sql\_select.cc:544

#19 0x00005640d588eb96 in Sql_cmd_create_table_like::execute (

this=<optimized out>, thd=0x62b00007e218)

at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/sql\_table.cc:11746

#20 0x00005640d5591a67 in mysql_execute_command (thd=<optimized out>,

is\_called\_from\_prepared\_stmt=<optimized out>)

at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/sql\_parse.cc:5995

#21 0x00005640d55508dd in mysql_parse (thd=0x62b00007e218,

rawbuf=<optimized out>, length=<optimized out>,

parser\_state=<optimized out>)

at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/sql\_parse.cc:8028

#22 0x00005640d55862a4 in dispatch_command (command=COM_QUERY,

thd=0x62b00007e218, packet=<optimized out>, packet\_length=<optimized out>,

blocking=<optimized out>)

at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/sql\_class.h:233

#23 0x00005640d558b704 in do_command (thd=0x62b00007e218,

blocking=blocking@entry=0x1)

at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/sql\_parse.cc:1406

#24 0x00005640d5a4b14d in do_handle_one_connection (connect=<optimized out>,

put\_in\_cache=<optimized out>)

at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/sql\_connect.cc:1410

#25 0x00005640d5a4c807 in handle_one_connection (arg=arg@entry=0x608005322038)

at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/sql\_connect.cc:1312

#26 0x00005640d6897ef0 in pfs_spawn_thread (arg=0x617000005118)

at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/storage/perfschema/pfs.cc:2201

#27 0x00007f155f9fb609 in start_thread (arg=<optimized out>)

at pthread\_create.c:477

#28 0x00007f155f5cf293 in clone ()

at ../sysdeps/unix/sysv/linux/x86\_64/clone.S:95

gdb-peda$ quit

Related news

CVE-2022-27377: [MDEV-26281] ASAN use-after-poison when complex conversion is involved in blob

MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component Item_func_in::cleanup(), which is exploited via specially crafted SQL statements.

CVE-2022-27378: [MDEV-26423] MariaDB server crash in Create_tmp_table::finalize

An issue in the component Create_tmp_table::finalize of MariaDB Server v10.7 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL statements.

CVE-2022-27379: [MDEV-26353] MariaDB server crash in Arg_comparator::compare_real_fixed

An issue in the component Arg_comparator::compare_real_fixed of MariaDB Server v10.6.2 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL statements.

CVE-2022-27384: [MDEV-26047] MariaDB server crash at Item_subselect::init_expr_cache_tracker

An issue in the component Item_subselect::init_expr_cache_tracker of MariaDB Server v10.6 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL statements.

CVE-2022-27385: [MDEV-26415] MariaDB server crash in Used_tables_and_const_cache::used_tables_and_const_cache_join

An issue in the component Used_tables_and_const_cache::used_tables_and_const_cache_join of MariaDB Server v10.7 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL statements.

CVE-2022-27383: [MDEV-26323] use-after-poison issue of MariaDB server

MariaDB Server v10.6 and below was discovered to contain an use-after-free in the component my_strcasecmp_8bit, which is exploited via specially crafted SQL statements.

CVE-2022-27387: [MDEV-26422] ASAN: global-buffer-overflow in decimal_bin_size on SELECT

MariaDB Server v10.7 and below was discovered to contain a global buffer overflow in the component decimal_bin_size, which is exploited via specially crafted SQL statements.

CVE-2022-24070: 65861 – [PATCH] Document how the post_config hook is called

Subversion's mod_dav_svn is vulnerable to memory corruption. While looking up path-based authorization rules, mod_dav_svn servers may attempt to use memory which has already been freed. Affected Subversion mod_dav_svn servers 1.10.0 through 1.14.1 (inclusive). Servers that do not use mod_dav_svn are not affected.

CVE-2022-24842: Build software better, together

MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. A security issue was found where an non-admin user is able to create service accounts for root or other admin users and then is able to assume their access policies via the generated credentials. This in turn allows the user to escalate privilege to that of the root user. This vulnerability has been resolved in pull request #14729 and is included in `RELEASE.2022-04-12T06-55-35Z`. Users unable to upgrade may workaround this issue by explicitly adding a `admin:CreateServiceAccount` deny policy, however, this, in turn, denies the user the ability to create their own service accounts as well.

CVE-2022-27952: GitHub - payloadcms/payload: Headless CMS and Application Framework built with TypeScript, Node.js, React and MongoDB

An arbitrary file upload vulnerability in the file upload module of PayloadCMS v0.15.0 allows attackers to execute arbitrary code via a crafted SVG file.

CVE-2022-24812: Build software better, together

Grafana is an open-source platform for monitoring and observability. When fine-grained access control is enabled and a client uses Grafana API Key to make requests, the permissions for that API Key are cached for 30 seconds for the given organization. Because of the way the cache ID is constructed, the consequent requests with any API Key evaluate to the same permissions as the previous requests. This can lead to an escalation of privileges, when for example a first request is made with Admin permissions, and the second request with different API Key is made with Viewer permissions, the second request will get the cached permissions from the previous Admin, essentially accessing higher privilege than it should. The vulnerability is only impacting Grafana Enterprise when the fine-grained access control beta feature is enabled and there are more than one API Keys in one organization with different roles assigned. All installations after Grafana Enterprise v8.1.0-beta1 should be upgraded ...

CVE-2022-28397: Ghost Customers – A showcase of real sites built with Ghost

An arbitrary file upload vulnerability in the file upload module of Ghost CMS v4.42.0 allows attackers to execute arbitrary code via a crafted file.

CVE-2022-27263: GitHub - strapi/strapi: 🚀 Open source Node.js Headless CMS to easily build customisable APIs

An arbitrary file upload vulnerability in the file upload module of Strapi v4.1.5 allows attackers to execute arbitrary code via a crafted file.

CVE-2022-28347: security - Django: CVE-2022-28346: Potential SQL injection in ``QuerySet.annotate()``, ``aggregate()``, and ``extra()``

A SQL injection issue was discovered in QuerySet.explain() in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. This occurs by passing a crafted dictionary (with dictionary expansion) as the **options argument, and placing the injection payload in an option name.

CVE-2022-24836: Build software better, together

Nokogiri is an open source XML and HTML library for Ruby. Nokogiri `< v1.13.4` contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to detect encoding in HTML documents. Users are advised to upgrade to Nokogiri `>= 1.13.4`. There are no known workarounds for this issue.

CVE-2022-24827: Build software better, together

Elide is a Java library that lets you stand up a GraphQL/JSON-API web service with minimal effort. When leveraging the following together: Elide Aggregation Data Store for Analytic Queries, Parameterized Columns (A column that requires a client provided parameter), and a parameterized column of type TEXT. There is the potential for a hacker to provide a carefully crafted query that would bypass server side authorization filters through SQL injection. A recent patch to Elide 6.1.2 allowed the '-' character to be included in parameterized TEXT columns. This character can be interpreted as SQL comments ('--') and allow the attacker to remove the WHERE clause from the generated query and bypass authorization filters. A fix is provided in Elide 6.1.4. The vulnerability only exists for parameterized columns of type TEXT and only for analytic queries (CRUD is not impacted). Workarounds include leveraging a different type of parameterized column (TIME, MONEY, etc) or not leveraging parameteriz...

CVE-2022-24832: Bump bundled gocd-ldap-authentication-plugin to v2.2.0-144 by chadlwilson · Pull Request #10244 · gocd/gocd

GoCD is an open source a continuous delivery server. The bundled gocd-ldap-authentication-plugin included with the GoCD Server fails to correctly escape special characters when using the username to construct LDAP queries. While this does not directly allow arbitrary LDAP data exfiltration, it can allow an existing LDAP-authenticated GoCD user with malicious intent to construct and execute malicious queries, allowing them to deduce facts about other users or entries within the LDAP database (e.g alternate fields, usernames, hashed passwords etc) through brute force mechanisms. This only affects users who have a working LDAP authorization configuration enabled on their GoCD server, and only is exploitable by users authenticating using such an LDAP configuration. This issue has been fixed in GoCD 22.1.0, which is bundled with gocd-ldap-authentication-plugin v2.2.0-144.

CVE-2022-24833: Sanitize SVG preview, preventing script execution in instance context… · PrivateBin/PrivateBin@2a4d572

PrivateBin is minimalist, open source online pastebin clone where the server has zero knowledge of pasted data. In PrivateBin < v1.4.0 a cross-site scripting (XSS) vulnerability was found. The vulnerability is present in all versions from v0.21 of the project, which was at the time still called ZeroBin. The issue is caused by the fact that SVGs can contain JavaScript. This can allow an attacker to execute code, if the user opens a paste with a specifically crafted SVG attachment, and interacts with the preview image and the instance isn't protected by an appropriate content security policy. Users are advised to either upgrade to version 1.4.0 or to ensure the content security policy of their instance is set correctly.

CVE-2022-24829: Build software better, together

Garden is an automation platform for Kubernetes development and testing. In versions prior to 0.12.39 multiple endpoints did not require authentication. In some operating modes this allows for an attacker to gain access to the application erroneously. The configuration is leaked through the /api endpoint on the local server that is responsible for serving the Garden dashboard. At the moment, this server is accessible to 0.0.0.0 which makes it accessible to anyone on the same network (or anyone on the internet if they are on a public, static IP). This may lead to the ability to compromise credentials, secrets or environment variables. Users are advised to upgrade to version 0.12.39 as soon as possible. Users unable to upgrade should use a firewall blocking access to port 9777 from all untrusted network machines.

CVE-2022-24815: use conditions instead of criteria as workaround · jhipster/generator-jhipster@c220a21

JHipster is a development platform to quickly generate, develop, & deploy modern web applications & microservice architectures. SQL Injection vulnerability in entities for applications generated with the option "reactive with Spring WebFlux" enabled and an SQL database using r2dbc. Applications created without "reactive with Spring WebFlux" and applications with NoSQL databases are not affected. Users who have generated a microservice Gateway using the affected version may be impacted as Gateways are reactive by default. Currently, SQL injection is possible in the findAllBy(Pageable pageable, Criteria criteria) method of an entity repository class generated in these applications as the where clause using Criteria for queries are not sanitized and user input is passed on as it is by the criteria. This issue has been patched in v7.8.1. Users unable to upgrade should be careful when combining criterias and conditions as the root of the issue lies in the `EntityManager.java` class when cre...

CVE: Latest News

CVE-2023-50976: Transactions API Authorization by oleiman · Pull Request #14969 · redpanda-data/redpanda
CVE-2023-6905
CVE-2023-6903
CVE-2023-6904
CVE-2023-3907