Bug 29338

Summary: MariaDB: 10.5.12 fixes security Issues
Product: Mageia Reporter: Marc Krämer <mageia>
Component: SecurityAssignee: QA Team <qa-bugs>
Status: RESOLVED FIXED QA Contact: Sec team <security>
Severity: normal    
Priority: Normal CC: andrewsfarm, bequimao.de, herman.viaene, polodrawers5, sysadmin-bugs
Version: 8Keywords: advisory, validated_update
Target Milestone: ---   
Hardware: All   
OS: Linux   
Whiteboard: MGA8-64-OK
Source RPM: mariadb CVE:
Status comment:

Comment 1 Marc Krämer 2021-08-07 11:36:21 CEST 
Updated mariadb packages fix security vulnerabilities:

Two security issues have been fixed which allows high privileged attacker with network access via multiple protocols to compromise MySQL Server [1,2]

This update also fixes some bugs in InnoDB engine and optimizer unit [3]


References:
[1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-2372
[2] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-2389
[3] https://mariadb.com/kb/en/mariadb-10512-release-notes/
========================

Updated packages in core/updates_testing:
========================
mariadb-spider-10.5.12-1.mga8
mariadb-connect-10.5.12-1.mga8
mariadb-sphinx-debuginfo-10.5.12-1.mga8
lib64mariadb3-debuginfo-10.5.12-1.mga8
mariadb-feedback-debuginfo-10.5.12-1.mga8
mariadb-obsolete-debuginfo-10.5.12-1.mga8
mariadb-10.5.12-1.mga8
mariadb-extra-debuginfo-10.5.12-1.mga8
lib64mariadb3-10.5.12-1.mga8
mariadb-common-core-10.5.12-1.mga8
mariadb-sequence-debuginfo-10.5.12-1.mga8
mariadb-sphinx-10.5.12-1.mga8
mariadb-extra-10.5.12-1.mga8
mariadb-obsolete-10.5.12-1.mga8
mariadb-pam-10.5.12-1.mga8
mariadb-pam-debuginfo-10.5.12-1.mga8
mariadb-sequence-10.5.12-1.mga8
mariadb-feedback-10.5.12-1.mga8
lib64mariadb-devel-debuginfo-10.5.12-1.mga8
mysql-MariaDB-10.5.12-1.mga8
mariadb-spider-debuginfo-10.5.12-1.mga8
mariadb-bench-debuginfo-10.5.12-1.mga8
lib64mariadb-devel-10.5.12-1.mga8
mariadb-connect-debuginfo-10.5.12-1.mga8
mariadb-mroonga-10.5.12-1.mga8
mariadb-client-10.5.12-1.mga8
mariadb-client-debuginfo-10.5.12-1.mga8
mariadb-mroonga-debuginfo-10.5.12-1.mga8
lib64mariadbd19-10.5.12-1.mga8
mariadb-core-10.5.12-1.mga8
mariadb-rocks-10.5.12-1.mga8
lib64mariadb-embedded-devel-10.5.12-1.mga8
mariadb-common-10.5.12-1.mga8
mariadb-debuginfo-10.5.12-1.mga8
mariadb-debugsource-10.5.12-1.mga8
lib64mariadbd19-debuginfo-10.5.12-1.mga8
mariadb-core-debuginfo-10.5.12-1.mga8
mariadb-common-debuginfo-10.5.12-1.mga8
mariadb-bench-10.5.12-1.mga8
lib64mariadb-embedded-devel-debuginfo-10.5.12-1.mga8
mariadb-rocks-debuginfo-10.5.12-1.mga8

SRPM:
mariadb-10.5.12-1.mga8.src.rpm

Assignee: mageia => qa-bugs

Ulrich Beckmann 2021-08-08 21:56:17 CEST

CC: (none) => bequimao.de

Comment 2 Herman Viaene 2021-08-09 14:51:41 CEST 
MGA8-64 Plasma on Lenovo B50
No installation issues. Omitted all debuginfo and debugsource packages.
# systemctl -l status mysqld
● mysqld.service - MySQL database server
     Loaded: loaded (/usr/lib/systemd/system/mysqld.service; disabled; vendor preset: disabled)
     Active: inactive (dead)
# systemctl  start mysqld
# systemctl -l status mysqld
● mysqld.service - MySQL database server
     Loaded: loaded (/usr/lib/systemd/system/mysqld.service; disabled; vendor preset: disabled)
     Active: active (running) since Mon 2021-08-09 14:36:14 CEST; 3s ago
    Process: 65420 ExecStartPre=/usr/sbin/mysqld-prepare-db-dir (code=exited, status=0/SUCCESS)
   Main PID: 65434 (mysqld)
     Status: "Taking your SQL requests now..."
      Tasks: 43 (limit: 9402)
     Memory: 87.7M
        CPU: 337ms
     CGroup: /system.slice/mysqld.service
             └─65434 /usr/sbin/mysqld

aug 09 14:36:13 mach5.hviaene.thuis mysqld[65434]: 2021-08-09 14:36:13 0 [Note] InnoDB: 10.5.12 started; log sequence number 6833610; transaction id 3191
aug 09 14:36:13 mach5.hviaene.thuis mysqld[65434]: 2021-08-09 14:36:13 0 [Note] InnoDB: Loading buffer pool(s) from /var/lib/mysql/ib_buffer_pool
aug 09 14:36:13 mach5.hviaene.thuis mysqld[65434]: 2021-08-09 14:36:13 0 [Note] CONNECT: Version 1.07.0002 March 22, 2021
aug 09 14:36:13 mach5.hviaene.thuis mysqld[65434]: 210809 14:36:13 server_audit: MariaDB Audit Plugin version 1.4.13 STARTED.
aug 09 14:36:14 mach5.hviaene.thuis mysqld[65434]: 210809 14:36:13 server_audit: Query cache is enabled with the TABLE events. Some table reads can be veiled.2021-08-09 14:36:14 0 [Note] Re>
aug 09 14:36:14 mach5.hviaene.thuis mysqld[65434]: 2021-08-09 14:36:14 0 [Note] Added new Master_info '' to hash table
aug 09 14:36:14 mach5.hviaene.thuis mysqld[65434]: 2021-08-09 14:36:14 0 [Note] /usr/sbin/mysqld: ready for connections.
aug 09 14:36:14 mach5.hviaene.thuis mysqld[65434]: Version: '10.5.12-MariaDB'  socket: '/var/lib/mysql/mysql.sock'  port: 0  Mageia MariaDB Server
aug 09 14:36:14 mach5.hviaene.thuis systemd[1]: Started MySQL database server.
aug 09 14:36:18 mach5.hviaene.thuis mysqld[65434]: 2021-08-09 14:36:18 0 [Note] InnoDB: Buffer pool(s) load completed at 210809 14:36:18
[root@mach5 ~]# systemctl  start httpd
This last one to be able to use phpmyadmin.
Used this tool to delete an old testdatabase, created a new one, created a table with a primary key (serial type), a unique index on varchar field, another plain varchar field and a timstamp field.
Inserted some values in the varchar fields, letting mysql handle the PK and timestamp values.
All worked OK.

CC: (none) => herman.viaene
Whiteboard: (none) => MGA8-64-OK

Comment 3 Ulrich Beckmann 2021-08-09 17:18:51 CEST 
KMail and Akonadi working fine. No regression found.
Comment 4 Thomas Andrews 2021-08-11 13:46:51 CEST 
Validating. Advisory in Comment 1.

Keywords: (none) => validated_update
CC: (none) => andrewsfarm, sysadmin-bugs

Thomas Backlund 2021-08-14 14:36:03 CEST

Keywords: (none) => advisory

Comment 5 Mageia Robot 2021-08-14 16:01:47 CEST 
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2021-0402.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED

Comment 6 Leslie Wilkinson 2023-05-05 03:37:37 CEST Comment hidden (spam)

CC: (none) => polodrawers5