Headline
CVE-2022-25834: Percona XtraBackup - Percona XtraBackup 8.0.32-26 (2023-04-04)
In Percona XtraBackup (PXB) through 2.2.24 and 3.x through 8.0.27-19, a crafted filename on the local file system could trigger unexpected command shell execution of arbitrary commands.
Release date
April 4, 2023
Install instructions
Install Percona XtraBackup
Percona XtraBackup for MySQL Databases enables MySQL backups without blocking user queries. Percona XtraBackup is ideal for companies with large data sets and mission-critical applications that cannot tolerate long periods of downtime. Offered free as an open source solution, Percona XtraBackup drives down backup costs while providing unique features for MySQL backups.
Release highlights¶
This release includes improvements and bug fixes. Percona has implemented a two-stage release process for each version. The first release primarily ensures compatibility with the latest MySQL version, to help those customers who need an updated version of Percona XtraBackup as soon as possible. The second release contains additional bug fixes and any improvements or new features.
This release fixes the security vulnerability CVE-2022-25834 with PXB-2977.
This version adds the --estimate-memory parameter to enable/disable the Smart memory estimation feature during the backup phase.
Improvements¶
PXB-2882: Removes bitmap code and variables.
PXB-2979: The Smart memory estimation feature parses metadata from the redo log to estimate the required memory to prepare a backup. On write-intensive workloads, this behavior caused the delay of the redo follow thread.
PXB-2980: Adds the --estimate-memory parameter to enable/disable the Smart memory estimation feature during the backup phase.
Bug fixes¶
PXB-2264: When a table with the next auto incremental value 2 was exported using Percona XtraBackup, the table got the next auto incremental value 1 instead of 2.
PXB-2954: During prepare phase Percona XtraBackup uses Serialized Dictionary information (SDI) to create the tabels’s metadata. If there was an orphan table (leftover from a upgrade) without SDI information, Percona XtraBackup failed to prepare a backup.
PXB-2970: Removed unnecessary check for redo log files at the end of backup in case the redo archive was enabled.
PXB-2972: An error after the redo apply phase caused an assertion failure instead of a graceful exit.
PXB-2977: Fixed the security vulnerability CVE-2022-25834.
PXB-2998: Due to a server bug in the upgrade, the server leaves the dictionary tables in a temporary schema instead of the mysql schema. Percona Xtrabackup can now successfully prepare these backup directories.
PXB-2999: Removed the warning message that MLOG_INDEX_LOAD redo log record was found.
PXB-3022: Reduced the memory required for --prepare phase.
Useful links¶
The Percona XtraBackup GitHub location
Contribute to the documentation
For training, contact Percona Training - Start learning now.
Last update: 2023-04-05
Related news
Gentoo Linux Security Advisory 202408-15 - Multiple vulnerabilities have been discovered in Percona XtraBackup, the worst of which could lead to arbitrary code execution. Versions greater than or equal to 8.0.29.22 are affected.
Ubuntu Security Notice 6745-1 - It was discovered that in Percona XtraBackup, a local crafted filename could trigger arbitrary code execution.