p PatchFirst

PatchFirst · Vulnérabilités récentes

Vulnérabilités de la pile Bases de données · Page n° 29

Vulnérabilités publiées pour Bases de données au cours des 30 derniers jours : 81. Présentes dans le catalogue KEV : 0.

RSS ↗ JSON ↗
Filtrer les vulnérabilités
Bases de données

Vulnérabilités : 1413

  1. CVE-2023-22005

    Moyenne · CVSS 4.4EPSS 1,29%Correctif disponible

    CVE-2023-22005

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 8.0.33 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).

    mysql mysql-5.5 percona-server-5.6 percona-xtradb-cluster-5.6 mysql-8.0 mysql-8.0Systèmes d’exploitation Bases de données
    • Mettez à jour vers 8.0.34-0ubuntu0.20.04.1
    • Mettez à jour vers 8.0.34-0ubuntu0.22.04.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  2. CVE-2023-21950

    Moyenne · CVSS 4.9EPSS 1%Correctif disponible

    CVE-2023-21950

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 8.0.27 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

    mysql mysql-5.5 percona-server-5.6 percona-xtradb-cluster-5.6 mysql-8.0Systèmes d’exploitation Bases de données
    • Mettez à jour vers 8.0.28-0ubuntu0.20.04.3
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  3. CVE-2022-24834

    Élevée · CVSS 7EPSS 41,41%Correctif disponible

    Heap overflow issue with the Lua cjson library used by Redis

    Redis is an in-memory database that persists on disk. A specially crafted Lua script executing in Redis can trigger a heap overflow in the cjson library, and result with heap corruption and potentially remote code execution. The problem exists in all versions of Redis with Lua scripting support, starting from 2.6, and affects only authenticated and authorized users. The problem is fixed in versions 7.0.12, 6.2.13, and 6.0.20.

    redis redis redis redis redis redis lua-cjson lua-cjson redis lua-cjson redis lua-cjsonSystèmes d’exploitation Bases de données
    • Mettez à jour vers 2.1.0+dfsg-2.1ubuntu0.20.04.1~esm2
    • Mettez à jour vers 2.1.0+dfsg-2.1ubuntu0.22.04.1~esm2
    • Mettez à jour vers 2:2.8.4-2ubuntu0.2+esm3
    • Mettez à jour vers 2:3.0.6-1ubuntu0.4+esm2
    • Mettez à jour vers 5:4.0.9-1ubuntu0.2+esm4
    • Mettez à jour vers 5:5.0.7-2ubuntu0.1+esm2
    • Mettez à jour vers 5:6.0.16-1ubuntu1+esm1
    • Mettez à jour vers 5:7.0.12-1
    • Mettez à jour vers 5:7.0.15-1~deb12u1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  4. CVE-2023-36824

    Élevée · CVSS 7.4EPSS 77,42%Correctif disponible

    Heap overflow in COMMAND GETKEYS and ACL evaluation in Redis

    Redis is an in-memory database that persists on disk. In Redit 7.0 prior to 7.0.12, extracting key names from a command and a list of arguments may, in some cases, trigger a heap overflow and result in reading random heap memory, heap corruption and potentially remote code execution. Several scenarios that may lead to authenticated users executing a specially crafted `COMMAND GETKEYS` or `COMMAND GETKEYSANDFLAGS`and authenticated users who were set with ACL rules that match key names, executing a specially crafted command that refers to a variadic list of key names. The vulnerability is patched in Redis 7.0.12.

    redis redis redis redisSystèmes d’exploitation Bases de données
    • Mettez à jour vers 5:7.0.12-1
    • Mettez à jour vers 5:7.0.15-1~deb12u1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  5. CVE-2023-2455

    Moyenne · CVSS 5.4EPSS 0,7%Correctif disponible

    CVE-2023-2455

    Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies to be applied in certain cases where role-specific policies are used and a given query is planned under one role and then executed under other roles. This scenario can happen under security definer functions or when a common user and query is planned initially and then re-used across multiple SET ROLEs. Applying an incorrect policy may permit a user to complete otherwise-forbidden reads and modifications. This affects only databases that have used CREATE POLICY to define a row security policy.

    postgresql postgresql-15 postgresql-9.3 postgresql-9.5 postgresql-10 postgresql-12 postgresql-14Systèmes d’exploitation Bases de données
    • Mettez à jour vers 10.23-0ubuntu0.18.04.2
    • Mettez à jour vers 12.15-0ubuntu0.20.04.1
    • Mettez à jour vers 14.8-0ubuntu0.22.04.1
    • Mettez à jour vers 15.3-0+deb12u1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  6. CVE-2023-2454

    Élevée · CVSS 7.2EPSS 1,2%Correctif disponible

    CVE-2023-2454

    schema_element defeats protective search_path changes; It was found that certain database calls in PostgreSQL could permit an authed attacker with elevated database-level privileges to execute arbitrary code.

    postgresql postgresql-15 postgresql-9.3 postgresql-9.5 postgresql-10 postgresql-12 postgresql-14Systèmes d’exploitation Bases de données
    • Mettez à jour vers 10.23-0ubuntu0.18.04.2
    • Mettez à jour vers 12.15-0ubuntu0.20.04.1
    • Mettez à jour vers 14.8-0ubuntu0.22.04.1
    • Mettez à jour vers 15.3-0+deb12u1
    • Mettez à jour vers 9.5.25-0ubuntu0.16.04.1+esm4
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  7. CVE-2023-28856

    Moyenne · CVSS 5.5EPSS 1,26%Correctif disponible

    `HINCRBYFLOAT` can be used to crash a redis-server process

    Redis is an open source, in-memory database that persists on disk. Authenticated users can use the `HINCRBYFLOAT` command to create an invalid hash field that will crash Redis on access in affected versions. This issue has been addressed in in versions 7.0.11, 6.2.12, and 6.0.19. Users are advised to upgrade. There are no known workarounds for this issue.

    redis redis redis redis redis redis redis redis redisSystèmes d’exploitation Bases de données
    • Mettez à jour vers 2:2.8.4-2ubuntu0.2+esm3
    • Mettez à jour vers 2:3.0.6-1ubuntu0.4+esm2
    • Mettez à jour vers 5:4.0.9-1ubuntu0.2+esm4
    • Mettez à jour vers 5:5.0.7-2ubuntu0.1+esm2
    • Mettez à jour vers 5:6.0.16-1ubuntu1+esm1
    • Mettez à jour vers 5:7.0.11-1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  8. CVE-2023-21982

    Moyenne · CVSS 4.9EPSS 1,13%Correctif disponible

    CVE-2023-21982

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

    mysql mysql-5.5 percona-server-5.6 percona-xtradb-cluster-5.6 mysql-8.0 mysql-8.0Systèmes d’exploitation Bases de données
    • Mettez à jour vers 8.0.33-0ubuntu0.20.04.1
    • Mettez à jour vers 8.0.33-0ubuntu0.22.04.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  9. CVE-2023-21980

    Élevée · CVSS 7.1EPSS 0,83%Correctif disponible

    CVE-2023-21980

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Client programs). Supported versions that are affected are 5.7.41 and prior and 8.0.32 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Server. CVSS 3.1 Base Score 7.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H).

    mysql mysql-5.5 mysql-5.7 percona-server-5.6 percona-xtradb-cluster-5.6 mysql-5.7 mysql-8.0 mysql-8.0Systèmes d’exploitation Bases de données
    • Mettez à jour vers 5.7.42-0ubuntu0.16.04.1+esm1
    • Mettez à jour vers 5.7.42-0ubuntu0.18.04.1
    • Mettez à jour vers 8.0.33-0ubuntu0.20.04.1
    • Mettez à jour vers 8.0.33-0ubuntu0.22.04.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  10. CVE-2023-21977

    Moyenne · CVSS 4.9EPSS 1,13%Correctif disponible

    CVE-2023-21977

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

    mysql mysql-5.5 percona-server-5.6 percona-xtradb-cluster-5.6 mysql-8.0 mysql-8.0Systèmes d’exploitation Bases de données
    • Mettez à jour vers 8.0.33-0ubuntu0.20.04.1
    • Mettez à jour vers 8.0.33-0ubuntu0.22.04.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  11. CVE-2023-21976

    Moyenne · CVSS 4.9EPSS 1,14%Correctif disponible

    CVE-2023-21976

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

    mysql mysql-5.5 percona-server-5.6 percona-xtradb-cluster-5.6 mysql-8.0 mysql-8.0Systèmes d’exploitation Bases de données
    • Mettez à jour vers 8.0.33-0ubuntu0.20.04.1
    • Mettez à jour vers 8.0.33-0ubuntu0.22.04.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  12. CVE-2023-21972

    Moyenne · CVSS 4.9EPSS 1,14%Correctif disponible

    CVE-2023-21972

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

    mysql mysql-5.5 percona-server-5.6 percona-xtradb-cluster-5.6 mysql-8.0 mysql-8.0Systèmes d’exploitation Bases de données
    • Mettez à jour vers 8.0.33-0ubuntu0.20.04.1
    • Mettez à jour vers 8.0.33-0ubuntu0.22.04.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  13. CVE-2023-21966

    Moyenne · CVSS 4.9EPSS 1,12%Correctif disponible

    CVE-2023-21966

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: JSON). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

    mysql mysql-5.5 percona-server-5.6 percona-xtradb-cluster-5.6 mysql-8.0 mysql-8.0Systèmes d’exploitation Bases de données
    • Mettez à jour vers 8.0.33-0ubuntu0.20.04.1
    • Mettez à jour vers 8.0.33-0ubuntu0.22.04.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  14. CVE-2023-21963

    Faible · CVSS 2.7EPSS 1%Correctif disponible

    CVE-2023-21963

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Connection Handling). Supported versions that are affected are 5.7.40 and prior and 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server. CVSS 3.1 Base Score 2.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L).

    mysql mysql-5.5 mysql-5.7 percona-server-5.6 percona-xtradb-cluster-5.6 mysql-5.7 mysql-8.0 mysql-8.0Systèmes d’exploitation Bases de données
    • Mettez à jour vers 5.7.41-0ubuntu0.16.04.1+esm1
    • Mettez à jour vers 5.7.41-0ubuntu0.18.04.1
    • Mettez à jour vers 8.0.32-0buntu0.20.04.1
    • Mettez à jour vers 8.0.32-0buntu0.22.04.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  15. CVE-2023-21962

    Moyenne · CVSS 4.9EPSS 1,39%Correctif disponible

    CVE-2023-21962

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Components Services). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

    mysql mysql-5.5 percona-server-5.6 percona-xtradb-cluster-5.6 mysql-8.0 mysql-8.0Systèmes d’exploitation Bases de données
    • Mettez à jour vers 8.0.33-0ubuntu0.20.04.1
    • Mettez à jour vers 8.0.33-0ubuntu0.22.04.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  16. CVE-2023-21955

    Moyenne · CVSS 4.9EPSS 1,39%Correctif disponible

    CVE-2023-21955

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Partition). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

    mysql mysql-5.5 percona-server-5.6 percona-xtradb-cluster-5.6 mysql-8.0 mysql-8.0Systèmes d’exploitation Bases de données
    • Mettez à jour vers 8.0.33-0ubuntu0.20.04.1
    • Mettez à jour vers 8.0.33-0ubuntu0.22.04.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  17. CVE-2023-21953

    Moyenne · CVSS 4.9EPSS 1,46%Correctif disponible

    CVE-2023-21953

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Partition). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

    mysql mysql-5.5 percona-server-5.6 percona-xtradb-cluster-5.6 mysql-8.0 mysql-8.0Systèmes d’exploitation Bases de données
    • Mettez à jour vers 8.0.33-0ubuntu0.20.04.1
    • Mettez à jour vers 8.0.33-0ubuntu0.22.04.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  18. CVE-2023-21947

    Moyenne · CVSS 4.4EPSS 1,37%Correctif disponible

    CVE-2023-21947

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Components Services). Supported versions that are affected are 8.0.32 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).

    mysql mysql-5.5 percona-server-5.6 percona-xtradb-cluster-5.6 mysql-8.0 mysql-8.0Systèmes d’exploitation Bases de données
    • Mettez à jour vers 8.0.33-0ubuntu0.20.04.1
    • Mettez à jour vers 8.0.33-0ubuntu0.22.04.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  19. CVE-2023-21946

    Moyenne · CVSS 6.5EPSS 1,5%Correctif disponible

    CVE-2023-21946

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

    mysql mysql-5.5 percona-server-5.6 percona-xtradb-cluster-5.6 mysql-8.0 mysql-8.0Systèmes d’exploitation Bases de données
    • Mettez à jour vers 8.0.33-0ubuntu0.20.04.1
    • Mettez à jour vers 8.0.33-0ubuntu0.22.04.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  20. CVE-2023-21945

    Moyenne · CVSS 4.9EPSS 1,4%Correctif disponible

    CVE-2023-21945

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

    mysql mysql-5.5 percona-server-5.6 percona-xtradb-cluster-5.6 mysql-8.0 mysql-8.0Systèmes d’exploitation Bases de données
    • Mettez à jour vers 8.0.33-0ubuntu0.20.04.1
    • Mettez à jour vers 8.0.33-0ubuntu0.22.04.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

Vérifiez votre serveur

Comparez votre pile et les versions installées aux bases de vulnérabilités actuelles.

Vérifiez votre serveur →