Security
Headlines
HeadlinesLatestCVEs

Headline

CVE-2022-25834: Percona XtraBackup - Percona XtraBackup 8.0.32-26 (2023-04-04)

In Percona XtraBackup (PXB) through 2.2.24 and 3.x through 8.0.27-19, a crafted filename on the local file system could trigger unexpected command shell execution of arbitrary commands.

CVE
#sql#vulnerability#git

Release date

April 4, 2023

Install instructions

Install Percona XtraBackup

Percona XtraBackup for MySQL Databases enables MySQL backups without blocking user queries. Percona XtraBackup is ideal for companies with large data sets and mission-critical applications that cannot tolerate long periods of downtime. Offered free as an open source solution, Percona XtraBackup drives down backup costs while providing unique features for MySQL backups.

Release highlights¶

This release includes improvements and bug fixes. Percona has implemented a two-stage release process for each version. The first release primarily ensures compatibility with the latest MySQL version, to help those customers who need an updated version of Percona XtraBackup as soon as possible. The second release contains additional bug fixes and any improvements or new features.

This release fixes the security vulnerability CVE-2022-25834 with PXB-2977.

This version adds the --estimate-memory parameter to enable/disable the Smart memory estimation feature during the backup phase.

Improvements¶

PXB-2882: Removes bitmap code and variables.

PXB-2979: The Smart memory estimation feature parses metadata from the redo log to estimate the required memory to prepare a backup. On write-intensive workloads, this behavior caused the delay of the redo follow thread.

PXB-2980: Adds the --estimate-memory parameter to enable/disable the Smart memory estimation feature during the backup phase.

Bug fixes¶

PXB-2264: When a table with the next auto incremental value 2 was exported using Percona XtraBackup, the table got the next auto incremental value 1 instead of 2.

PXB-2954: During prepare phase Percona XtraBackup uses Serialized Dictionary information (SDI) to create the tabels’s metadata. If there was an orphan table (leftover from a upgrade) without SDI information, Percona XtraBackup failed to prepare a backup.

PXB-2970: Removed unnecessary check for redo log files at the end of backup in case the redo archive was enabled.

PXB-2972: An error after the redo apply phase caused an assertion failure instead of a graceful exit.

PXB-2977: Fixed the security vulnerability CVE-2022-25834.

PXB-2998: Due to a server bug in the upgrade, the server leaves the dictionary tables in a temporary schema instead of the mysql schema. Percona Xtrabackup can now successfully prepare these backup directories.

PXB-2999: Removed the warning message that MLOG_INDEX_LOAD redo log record was found.

PXB-3022: Reduced the memory required for --prepare phase.

Useful links¶

The Percona XtraBackup GitHub location

Contribute to the documentation

For training, contact Percona Training - Start learning now.

Last update: 2023-04-05

Related news

Gentoo Linux Security Advisory 202408-15

Gentoo Linux Security Advisory 202408-15 - Multiple vulnerabilities have been discovered in Percona XtraBackup, the worst of which could lead to arbitrary code execution. Versions greater than or equal to 8.0.29.22 are affected.

Ubuntu Security Notice USN-6745-1

Ubuntu Security Notice 6745-1 - It was discovered that in Percona XtraBackup, a local crafted filename could trigger arbitrary code execution.

CVE: Latest News

CVE-2023-50976: Transactions API Authorization by oleiman · Pull Request #14969 · redpanda-data/redpanda
CVE-2023-6905
CVE-2023-6903
CVE-2023-6904
CVE-2023-3907