Vulnerability · Published Apr 12, 2022 · Assigned by mitre

CVE-2022-27376

High 7.5

In plain English

A high-severity security flaw in the Judy package (AlmaLinux). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.2% (higher than 83% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)7.5High

Exploit odds (30 days)2.2%top 17.4% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

MariaDB Server v10.6.5 and below was discovered to contain an use-after-free in the component Item_args::walk_arg, which is exploited via specially crafted SQL statements.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
AlmaLinux:8	Judy	1.0.5-18.module_el8.6.0+3139+3c630e87	ALSA-2022:6443
AlmaLinux:8	Judy	1.0.5-18.module_el8.6.0+3072+3c630e87	ALSA-2022:5826
AlmaLinux:8	Judy	1.0.5-18.module_el8.6.0+3072+3c630e87	ALSA-2022:6443
AlmaLinux:8	galera	25.3.35-1.module_el8.6.0+3265+230ed96b	ALSA-2022:6443
AlmaLinux:8	galera	26.4.11-1.module_el8.6.0+3072+3c630e87	ALSA-2022:5826
AlmaLinux:8	mariadb	3:10.3.35-1.module_el8.6.0+3265+230ed96b	ALSA-2022:6443
AlmaLinux:8	mariadb	3:10.5.16-2.module_el8.6.0+3072+3c630e87	ALSA-2022:5826
AlmaLinux:9	mariadb	3:10.5.16-2.el9_0	ALSA-2022:5948
AlmaLinux:8	mariadb-backup	3:10.3.35-1.module_el8.6.0+3265+230ed96b	ALSA-2022:6443
AlmaLinux:8	mariadb-backup	3:10.5.16-2.module_el8.6.0+3072+3c630e87	ALSA-2022:5826
AlmaLinux:9	mariadb-backup	3:10.5.16-2.el9_0	ALSA-2022:5948
AlmaLinux:8	mariadb-common	3:10.3.35-1.module_el8.6.0+3265+230ed96b	ALSA-2022:6443
AlmaLinux:8	mariadb-common	3:10.5.16-2.module_el8.6.0+3072+3c630e87	ALSA-2022:5826
AlmaLinux:9	mariadb-common	3:10.5.16-2.el9_0	ALSA-2022:5948
AlmaLinux:8	mariadb-devel	3:10.5.16-2.module_el8.6.0+3072+3c630e87	ALSA-2022:5826
AlmaLinux:8	mariadb-devel	3:10.3.35-1.module_el8.6.0+3265+230ed96b	ALSA-2022:6443
AlmaLinux:9	mariadb-devel	3:10.5.16-2.el9_0	ALSA-2022:5948
AlmaLinux:8	mariadb-embedded	3:10.3.35-1.module_el8.6.0+3265+230ed96b	ALSA-2022:6443
AlmaLinux:8	mariadb-embedded	3:10.5.16-2.module_el8.6.0+3072+3c630e87	ALSA-2022:5826
AlmaLinux:9	mariadb-embedded	3:10.5.16-2.el9_0	ALSA-2022:5948
AlmaLinux:8	mariadb-embedded-devel	3:10.5.16-2.module_el8.6.0+3072+3c630e87	ALSA-2022:5826
AlmaLinux:8	mariadb-embedded-devel	3:10.3.35-1.module_el8.6.0+3265+230ed96b	ALSA-2022:6443
AlmaLinux:9	mariadb-embedded-devel	3:10.5.16-2.el9_0	ALSA-2022:5948
AlmaLinux:8	mariadb-errmsg	3:10.5.16-2.module_el8.6.0+3072+3c630e87	ALSA-2022:5826
AlmaLinux:8	mariadb-errmsg	3:10.3.35-1.module_el8.6.0+3265+230ed96b	ALSA-2022:6443
AlmaLinux:9	mariadb-errmsg	3:10.5.16-2.el9_0	ALSA-2022:5948
AlmaLinux:8	mariadb-gssapi-server	3:10.3.35-1.module_el8.6.0+3265+230ed96b	ALSA-2022:6443
AlmaLinux:8	mariadb-gssapi-server	3:10.5.16-2.module_el8.6.0+3072+3c630e87	ALSA-2022:5826
AlmaLinux:9	mariadb-gssapi-server	3:10.5.16-2.el9_0	ALSA-2022:5948
AlmaLinux:8	mariadb-oqgraph-engine	3:10.5.16-2.module_el8.6.0+3072+3c630e87	ALSA-2022:5826
AlmaLinux:8	mariadb-oqgraph-engine	3:10.3.35-1.module_el8.6.0+3265+230ed96b	ALSA-2022:6443
AlmaLinux:9	mariadb-oqgraph-engine	3:10.5.16-2.el9_0	ALSA-2022:5948
AlmaLinux:8	mariadb-pam	3:10.5.16-2.module_el8.6.0+3072+3c630e87	ALSA-2022:5826
AlmaLinux:9	mariadb-pam	3:10.5.16-2.el9_0	ALSA-2022:5948
AlmaLinux:8	mariadb-server	3:10.5.16-2.module_el8.6.0+3072+3c630e87	ALSA-2022:5826
AlmaLinux:8	mariadb-server	3:10.3.35-1.module_el8.6.0+3265+230ed96b	ALSA-2022:6443
AlmaLinux:9	mariadb-server	3:10.5.16-2.el9_0	ALSA-2022:5948
AlmaLinux:8	mariadb-server-galera	3:10.3.35-1.module_el8.6.0+3265+230ed96b	ALSA-2022:6443
AlmaLinux:8	mariadb-server-galera	3:10.5.16-2.module_el8.6.0+3072+3c630e87	ALSA-2022:5826
AlmaLinux:9	mariadb-server-galera	3:10.5.16-2.el9_0	ALSA-2022:5948
AlmaLinux:8	mariadb-server-utils	3:10.5.16-2.module_el8.6.0+3072+3c630e87	ALSA-2022:5826
AlmaLinux:8	mariadb-server-utils	3:10.3.35-1.module_el8.6.0+3265+230ed96b	ALSA-2022:6443
AlmaLinux:9	mariadb-server-utils	3:10.5.16-2.el9_0	ALSA-2022:5948
AlmaLinux:8	mariadb-test	3:10.5.16-2.module_el8.6.0+3072+3c630e87	ALSA-2022:5826
AlmaLinux:8	mariadb-test	3:10.3.35-1.module_el8.6.0+3265+230ed96b	ALSA-2022:6443
AlmaLinux:9	mariadb-test	3:10.5.16-2.el9_0	ALSA-2022:5948
Alpine:v3.20	mariadb	10.6.8-r0	ALPINE-CVE-2022-27376
Alpine:v3.21	mariadb	10.6.8-r0	ALPINE-CVE-2022-27376
Alpine:v3.22	mariadb	10.6.8-r0	ALPINE-CVE-2022-27376
Alpine:v3.23	mariadb	10.6.8-r0	ALPINE-CVE-2022-27376
Alpine:v3.24	mariadb	10.6.8-r0	ALPINE-CVE-2022-27376
Rocky Linux:8	Judy	0:1.0.5-18.module+el8.4.0+427+adf35707	RLSA-2022:5826
Rocky Linux:8	Judy	0:1.0.5-18.module+el8.4.0+427+adf35707	RLSA-2022:6443
Rocky Linux:8	galera	0:25.3.35-1.module+el8.6.0+1005+cdf19c22	RLSA-2022:6443
Rocky Linux:8	galera	0:26.4.11-1.module+el8.6.0+995+5ac2a483	RLSA-2022:5826
Rocky Linux:9	galera	0:26.4.11-1.el9_0	RLSA-2022:5948
Rocky Linux:8	mariadb	3:10.3.35-1.module+el8.6.0+1005+cdf19c22	RLSA-2022:6443
Rocky Linux:8	mariadb	3:10.5.16-2.module+el8.6.0+995+5ac2a483	RLSA-2022:5826
Rocky Linux:9	mariadb	3:10.5.16-2.el9_0	RLSA-2022:5948
Rocky Linux:9	mysql-selinux	0:1.0.5-1.el9_0	RLSA-2022:5948
Ubuntu:22.04:LTS	mariadb-10.6	1:10.6.11-0ubuntu0.22.04.1	USN-5739-1
Ubuntu:22.04:LTS	mariadb-10.6	1:10.6.11-0ubuntu0.22.04.1	UBUNTU-CVE-2022-27376

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

References

https://jira.mariadb.org/browse/MDEV-26354 x_refsource_MISC
https://security.netapp.com/advisory/ntap-20220519-0007/ x_refsource_CONFIRM
[debian-lts-announce] 20220916 [SECURITY] [DLA 3114-1] mariadb-10.3 security update mailing-list, x_refsource_MLIST