SUSE-SU-2022:3159-1: important: Security update for mariadb
SUSE Security Update: Security update for mariadb
______________________________________________________________________________
Announcement ID: SUSE-SU-2022:3159-1
Rating: important
References: #1200105 #1201161 #1201162 #1201163 #1201164 #1201165 #1201166 #1201167 #1201168 #1201169 #1201170
Cross-References: CVE-2022-32081 CVE-2022-32082 CVE-2022-32083 CVE-2022-32084 CVE-2022-32085 CVE-2022-32086 CVE-2022-32087 CVE-2022-32088 CVE-2022-32089 CVE-2022-32091
CVSS scores:
CVE-2022-32081 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVE-2022-32081 (SUSE): 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CVE-2022-32082 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVE-2022-32082 (SUSE): 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CVE-2022-32083 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVE-2022-32083 (SUSE): 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CVE-2022-32084 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVE-2022-32084 (SUSE): 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CVE-2022-32085 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVE-2022-32085 (SUSE): 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CVE-2022-32086 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVE-2022-32086 (SUSE): 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CVE-2022-32087 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVE-2022-32087 (SUSE): 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CVE-2022-32088 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVE-2022-32088 (SUSE): 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CVE-2022-32089 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVE-2022-32089 (SUSE): 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CVE-2022-32091 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVE-2022-32091 (SUSE): 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Affected Products:
SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Server Applications 15-SP4
SUSE Linux Enterprise Server 15-SP4
SUSE Linux Enterprise Server for SAP Applications 15-SP4SUSE Manager Proxy 4.3
SUSE Manager Retail Branch Server 4.3
SUSE Manager Server 4.3
openSUSE Leap 15.4
______________________________________________________________________________
An update that solves 10 vulnerabilities and has one errata is now available.
Description:
This update for mariadb fixes the following issues:
- Updated to 10.6.9:
- CVE-2022-32082: Fixed a reachable assertion that would crash the server (bsc#1201162).
- CVE-2022-32089: Fixed a segmentation fault that coudl be triggered via
a crafted query (bsc#1201169).
- CVE-2022-32081: Fixed a buffer overflow on instant ADD/DROP of generated column (bsc#1201161).
- CVE-2022-32091: Fixed a memory corruption issue that could be triggered via a crafted query (bsc#1201170).
- CVE-2022-32084: Fixed a segmentation fault on INSERT SELECT queries (bsc#1201164).
- Additionaly, the following issues were previously fixed: - CVE-2022-32088: Fixed a server crash when using ORDER BY with window function and UNION(bsc#1201168).
- CVE-2022-32087: Fixed a segmentation fault that could be triggered via
a crafted query (bsc#1201167).
- CVE-2022-32086: Fixed a server crash on INSERT SELECT queries (bsc#1201166).
- CVE-2022-32085: Fixed a segmentation fault that could be triggered via
a crafted query (bsc#1201165).
- CVE-2022-32083: Fixed a segmentation fault that could be triggered via
a crafted query (bsc#1201163).
Bugfixes:
- Update mysql-systemd-helper to be aware of custom group (bsc#1200105).
Patch Instructions:
To install this SUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 15.4:
zypper in -t patch openSUSE-SLE-15.4-2022-3159=1
- SUSE Linux Enterprise Module for Server Applications 15-SP4:
zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP4-2022-3159=1
Package List:
- openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64):
libmariadbd-devel-10.6.9-150400.3.12.1
libmariadbd19-10.6.9-150400.3.12.1
libmariadbd19-debuginfo-10.6.9-150400.3.12.1
mariadb-10.6.9-150400.3.12.1
mariadb-bench-10.6.9-150400.3.12.1
mariadb-bench-debuginfo-10.6.9-150400.3.12.1
mariadb-client-10.6.9-150400.3.12.1
mariadb-client-debuginfo-10.6.9-150400.3.12.1
mariadb-debuginfo-10.6.9-150400.3.12.1
mariadb-debugsource-10.6.9-150400.3.12.1
mariadb-galera-10.6.9-150400.3.12.1
mariadb-rpm-macros-10.6.9-150400.3.12.1
mariadb-test-10.6.9-150400.3.12.1
mariadb-test-debuginfo-10.6.9-150400.3.12.1
mariadb-tools-10.6.9-150400.3.12.1
mariadb-tools-debuginfo-10.6.9-150400.3.12.1
- openSUSE Leap 15.4 (noarch):
mariadb-errormessages-10.6.9-150400.3.12.1
- SUSE Linux Enterprise Module for Server Applications 15-SP4 (aarch64 ppc64le s390x x86_64):
libmariadbd-devel-10.6.9-150400.3.12.1
libmariadbd19-10.6.9-150400.3.12.1
libmariadbd19-debuginfo-10.6.9-150400.3.12.1
mariadb-10.6.9-150400.3.12.1
mariadb-client-10.6.9-150400.3.12.1
mariadb-client-debuginfo-10.6.9-150400.3.12.1
mariadb-debuginfo-10.6.9-150400.3.12.1
mariadb-debugsource-10.6.9-150400.3.12.1
mariadb-tools-10.6.9-150400.3.12.1
mariadb-tools-debuginfo-10.6.9-150400.3.12.1
- SUSE Linux Enterprise Module for Server Applications 15-SP4 (noarch):
mariadb-errormessages-10.6.9-150400.3.12.1
References:
https://www.suse.com/security/cve/CVE-2022-32081.html
https://www.suse.com/security/cve/CVE-2022-32082.html
https://www.suse.com/security/cve/CVE-2022-32083.html
https://www.suse.com/security/cve/CVE-2022-32084.html
https://www.suse.com/security/cve/CVE-2022-32085.html
https://www.suse.com/security/cve/CVE-2022-32086.html
https://www.suse.com/security/cve/CVE-2022-32087.html
https://www.suse.com/security/cve/CVE-2022-32088.html
https://www.suse.com/security/cve/CVE-2022-32089.html
https://www.suse.com/security/cve/CVE-2022-32091.html
https://bugzilla.suse.com/1200105
https://bugzilla.suse.com/1201161
https://bugzilla.suse.com/1201162
https://bugzilla.suse.com/1201163
https://bugzilla.suse.com/1201164
https://bugzilla.suse.com/1201165
https://bugzilla.suse.com/1201166
https://bugzilla.suse.com/1201167
https://bugzilla.suse.com/1201168
https://bugzilla.suse.com/1201169
https://bugzilla.suse.com/1201170
A mariadb security update has been released for SUSE Linux Enterprise and openSUSE Leap 15.4.
