Vulnerability · Published Feb 1, 2022 · Assigned by mitre

CVE-2021-46668

Medium 5.5

In plain English

A medium-severity security flaw in the Judy package (AlmaLinux). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)5.5Medium

Exploit odds (30 days)0.4%top 65.6% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

MariaDB through 10.5.9 allows an application crash via certain long SELECT DISTINCT statements that improperly interact with storage-engine resource limitations for temporary data structures.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
AlmaLinux:8	Judy	1.0.5-18.module_el8.6.0+3139+3c630e87	ALSA-2022:6443
AlmaLinux:8	Judy	1.0.5-18.module_el8.6.0+3072+3c630e87	ALSA-2022:5826
AlmaLinux:8	Judy	1.0.5-18.module_el8.6.0+3072+3c630e87	ALSA-2022:6443
AlmaLinux:8	galera	25.3.35-1.module_el8.6.0+3265+230ed96b	ALSA-2022:6443
AlmaLinux:8	galera	26.4.11-1.module_el8.6.0+3072+3c630e87	ALSA-2022:5826
AlmaLinux:8	mariadb	3:10.3.35-1.module_el8.6.0+3265+230ed96b	ALSA-2022:6443
AlmaLinux:8	mariadb	3:10.5.16-2.module_el8.6.0+3072+3c630e87	ALSA-2022:5826
AlmaLinux:9	mariadb	3:10.5.16-2.el9_0	ALSA-2022:5948
AlmaLinux:8	mariadb-backup	3:10.3.35-1.module_el8.6.0+3265+230ed96b	ALSA-2022:6443
AlmaLinux:8	mariadb-backup	3:10.5.16-2.module_el8.6.0+3072+3c630e87	ALSA-2022:5826
AlmaLinux:9	mariadb-backup	3:10.5.16-2.el9_0	ALSA-2022:5948
AlmaLinux:8	mariadb-common	3:10.3.35-1.module_el8.6.0+3265+230ed96b	ALSA-2022:6443
AlmaLinux:8	mariadb-common	3:10.5.16-2.module_el8.6.0+3072+3c630e87	ALSA-2022:5826
AlmaLinux:9	mariadb-common	3:10.5.16-2.el9_0	ALSA-2022:5948
AlmaLinux:8	mariadb-devel	3:10.5.16-2.module_el8.6.0+3072+3c630e87	ALSA-2022:5826
AlmaLinux:8	mariadb-devel	3:10.3.35-1.module_el8.6.0+3265+230ed96b	ALSA-2022:6443
AlmaLinux:9	mariadb-devel	3:10.5.16-2.el9_0	ALSA-2022:5948
AlmaLinux:8	mariadb-embedded	3:10.3.35-1.module_el8.6.0+3265+230ed96b	ALSA-2022:6443
AlmaLinux:8	mariadb-embedded	3:10.5.16-2.module_el8.6.0+3072+3c630e87	ALSA-2022:5826
AlmaLinux:9	mariadb-embedded	3:10.5.16-2.el9_0	ALSA-2022:5948
AlmaLinux:8	mariadb-embedded-devel	3:10.5.16-2.module_el8.6.0+3072+3c630e87	ALSA-2022:5826
AlmaLinux:8	mariadb-embedded-devel	3:10.3.35-1.module_el8.6.0+3265+230ed96b	ALSA-2022:6443
AlmaLinux:9	mariadb-embedded-devel	3:10.5.16-2.el9_0	ALSA-2022:5948
AlmaLinux:8	mariadb-errmsg	3:10.5.16-2.module_el8.6.0+3072+3c630e87	ALSA-2022:5826
AlmaLinux:8	mariadb-errmsg	3:10.3.35-1.module_el8.6.0+3265+230ed96b	ALSA-2022:6443
AlmaLinux:9	mariadb-errmsg	3:10.5.16-2.el9_0	ALSA-2022:5948
AlmaLinux:8	mariadb-gssapi-server	3:10.3.35-1.module_el8.6.0+3265+230ed96b	ALSA-2022:6443
AlmaLinux:8	mariadb-gssapi-server	3:10.5.16-2.module_el8.6.0+3072+3c630e87	ALSA-2022:5826
AlmaLinux:9	mariadb-gssapi-server	3:10.5.16-2.el9_0	ALSA-2022:5948
AlmaLinux:8	mariadb-oqgraph-engine	3:10.5.16-2.module_el8.6.0+3072+3c630e87	ALSA-2022:5826
AlmaLinux:8	mariadb-oqgraph-engine	3:10.3.35-1.module_el8.6.0+3265+230ed96b	ALSA-2022:6443
AlmaLinux:9	mariadb-oqgraph-engine	3:10.5.16-2.el9_0	ALSA-2022:5948
AlmaLinux:8	mariadb-pam	3:10.5.16-2.module_el8.6.0+3072+3c630e87	ALSA-2022:5826
AlmaLinux:9	mariadb-pam	3:10.5.16-2.el9_0	ALSA-2022:5948
AlmaLinux:8	mariadb-server	3:10.5.16-2.module_el8.6.0+3072+3c630e87	ALSA-2022:5826
AlmaLinux:8	mariadb-server	3:10.3.35-1.module_el8.6.0+3265+230ed96b	ALSA-2022:6443
AlmaLinux:9	mariadb-server	3:10.5.16-2.el9_0	ALSA-2022:5948
AlmaLinux:8	mariadb-server-galera	3:10.3.35-1.module_el8.6.0+3265+230ed96b	ALSA-2022:6443
AlmaLinux:8	mariadb-server-galera	3:10.5.16-2.module_el8.6.0+3072+3c630e87	ALSA-2022:5826
AlmaLinux:9	mariadb-server-galera	3:10.5.16-2.el9_0	ALSA-2022:5948
AlmaLinux:8	mariadb-server-utils	3:10.5.16-2.module_el8.6.0+3072+3c630e87	ALSA-2022:5826
AlmaLinux:8	mariadb-server-utils	3:10.3.35-1.module_el8.6.0+3265+230ed96b	ALSA-2022:6443
AlmaLinux:9	mariadb-server-utils	3:10.5.16-2.el9_0	ALSA-2022:5948
AlmaLinux:8	mariadb-test	3:10.5.16-2.module_el8.6.0+3072+3c630e87	ALSA-2022:5826
AlmaLinux:8	mariadb-test	3:10.3.35-1.module_el8.6.0+3265+230ed96b	ALSA-2022:6443
AlmaLinux:9	mariadb-test	3:10.5.16-2.el9_0	ALSA-2022:5948
Alpine:v3.20	mariadb	10.6.7-r0	ALPINE-CVE-2021-46668
Alpine:v3.21	mariadb	10.6.7-r0	ALPINE-CVE-2021-46668
Alpine:v3.22	mariadb	10.6.7-r0	ALPINE-CVE-2021-46668
Alpine:v3.23	mariadb	10.6.7-r0	ALPINE-CVE-2021-46668
Alpine:v3.24	mariadb	10.6.7-r0	ALPINE-CVE-2021-46668
Rocky Linux:8	Judy	0:1.0.5-18.module+el8.4.0+427+adf35707	RLSA-2022:5826
Rocky Linux:8	Judy	0:1.0.5-18.module+el8.4.0+427+adf35707	RLSA-2022:6443
Rocky Linux:8	galera	0:25.3.35-1.module+el8.6.0+1005+cdf19c22	RLSA-2022:6443
Rocky Linux:8	galera	0:26.4.11-1.module+el8.6.0+995+5ac2a483	RLSA-2022:5826
Rocky Linux:9	galera	0:26.4.11-1.el9_0	RLSA-2022:5948
Rocky Linux:8	mariadb	3:10.5.16-2.module+el8.6.0+995+5ac2a483	RLSA-2022:5826
Rocky Linux:8	mariadb	3:10.3.35-1.module+el8.6.0+1005+cdf19c22	RLSA-2022:6443
Rocky Linux:9	mariadb	3:10.5.16-2.el9_0	RLSA-2022:5948
Rocky Linux:9	mysql-selinux	0:1.0.5-1.el9_0	RLSA-2022:5948
Ubuntu:22.04:LTS	mariadb-10.6	1:10.6.7-2ubuntu1	UBUNTU-CVE-2021-46668

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

References

https://jira.mariadb.org/browse/MDEV-25787 x_refsource_MISC
https://security.netapp.com/advisory/ntap-20220221-0002/ x_refsource_CONFIRM
https://mariadb.com/kb/en/security/ x_refsource_CONFIRM
FEDORA-2022-263f7cc483 vendor-advisory, x_refsource_FEDORA
FEDORA-2022-03350936ee vendor-advisory, x_refsource_FEDORA
FEDORA-2022-5cfe372ab7 vendor-advisory, x_refsource_FEDORA