p PatchFirst

PatchFirst · Latest vulnerabilities

Databases stack vulnerabilities · Page 23

Vulnerabilities published for Databases in the last 30 days: 81. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Databases

Vulnerabilities: 1413

  1. CVE-2024-31228

    Medium · CVSS 5.5EPSS 1.01%Fix available

    Denial-of-service due to unbounded pattern matching in Redis

    Redis is an open source, in-memory database that persists on disk. Authenticated users can trigger a denial-of-service by using specially crafted, long string match patterns on supported commands such as `KEYS`, `SCAN`, `PSUBSCRIBE`, `FUNCTION LIST`, `COMMAND LIST` and ACL definitions. Matching of extremely long patterns may result in unbounded recursion, leading to stack overflow and process crash. This problem has been fixed in Redis versions 6.2.16, 7.2.6, and 7.4.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

    redis redict redis redis redis valkey valkey redis redis redis redis redisOperating systems Databases
    • Update to 2:3.0.6-1ubuntu0.4+esm3
    • Update to 5:4.0.9-1ubuntu0.2+esm5
    • Update to 5:5.0.7-2ubuntu0.1+esm3
    • Update to 5:6.0.16-1ubuntu1+esm2
    • Update to 5:7.0.15-1ubuntu0.24.04.1
    • Update to 5:7.0.15-1~deb12u2
    • Update to 5:7.0.15-2
    • Update to 7.3.1+ds-1
    • Update to 8.0.1+dfsg1-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  2. CVE-2024-31227

    Medium · CVSS 4.4EPSS 0.4%Fix available

    Denial-of-service due to malformed ACL selectors in Redis

    Redis is an open source, in-memory database that persists on disk. An authenticated with sufficient privileges may create a malformed ACL selector which, when accessed, triggers a server panic and subsequent denial of service. The problem exists in Redis 7 prior to versions 7.2.6 and 7.4.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

    redis redict redis redis redis valkey valkey redisOperating systems Databases
    • Update to 5:7.0.15-1~deb12u2
    • Update to 5:7.0.15-2
    • Update to 7.3.1+ds-1
    • Update to 8.0.1+dfsg1-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  3. CVE-2024-7348

    High · CVSS 8.8EPSS 1.57%Fix available

    PostgreSQL relation replacement during pg_dump executes arbitrary SQL

    Time-of-check Time-of-use (TOCTOU) race condition in pg_dump in PostgreSQL allows an object creator to execute arbitrary SQL functions as the user running pg_dump, which is often a superuser. The attack involves replacing another relation type with a view or foreign table. The attack requires waiting for pg_dump to start, but winning the race condition is trivial if the attacker retains an open transaction. Versions before PostgreSQL 16.4, 15.8, 14.13, 13.16, and 12.20 are affected.

    postgresql postgresql-15 postgresql-9.3 postgresql-9.5 postgresql-10 postgresql-12 postgresql-14 postgresql-16Operating systems Databases
    • Update to 10.23-0ubuntu0.18.04.2+esm2
    • Update to 12.20
    • Update to 12.20-0ubuntu0.20.04.1
    • Update to 13.16
    • Update to 14.13
    • Update to 14.13-0ubuntu0.22.04.1
    • Update to 15.8
    • Update to 15.8-0+deb12u1
    • Update to 16.4
    • Update to 16.4-0ubuntu0.24.04.1
    • Update to 9.3.24-0ubuntu0.14.04+esm1
    • Update to 9.5.25-0ubuntu0.16.04.1+esm8
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  4. CVE-2024-6873

    High · CVSS 8.1EPSS 0.72%Fix available

    Specially crafted request could caused undefined behaviour which may lead to Remote Code Execution.

    It is possible to crash or redirect the execution flow of the ClickHouse server process from an unauthenticated vector by sending a specially crafted request to the ClickHouse server native interface. This redirection is limited to what is available within a 256-byte range of memory at the time of execution, and no known remote code execution (RCE) code has been produced or exploited.  Fixes have been merged to all currently supported version of ClickHouse. If you are maintaining your own forked version of ClickHouse or using an older version and cannot upgrade, the fix for this vulnerability can be found in this commit  https://github.com/C

    clickhouse clickhouse clickhouseOperating systems Databases
    • Update to v23.8.15.35-lts
    • Update to v24.3.4.147-lts
    • Update to v24.4.2.141-stable
    • Update to v24.5.1.1763
    • Update to v24.6.1.4423-stable
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  5. CVE-2024-21185

    Medium · CVSS 4.9EPSS 0.86%Fix available

    CVE-2024-21185

    Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.38, 8.4.1 and 9.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

    mysql mysql-5.5 mysql-5.7 percona-server-5.6 percona-xtradb-cluster-5.6 mysql-5.7 mysql-8.0 mysql-8.0 mysql-8.0Operating systems Databases
    • Update to 8.0.39-0ubuntu0.20.04.1
    • Update to 8.0.39-0ubuntu0.22.04.1
    • Update to 8.0.39-0ubuntu0.24.04.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  6. CVE-2024-21179

    Medium · CVSS 4.9EPSS 0.68%Fix available

    CVE-2024-21179

    Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.37 and prior and 8.4.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

    mysql mysql-5.5 mysql-5.7 percona-server-5.6 percona-xtradb-cluster-5.6 mysql-5.7 mysql-8.0 mysql-8.0 mysql-8.0Operating systems Databases
    • Update to 8.0.39-0ubuntu0.20.04.1
    • Update to 8.0.39-0ubuntu0.22.04.1
    • Update to 8.0.39-0ubuntu0.24.04.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  7. CVE-2024-21177

    Medium · CVSS 6.5EPSS 0.76%Fix available

    CVE-2024-21177

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.37 and prior and 8.4.0 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

    mysql ndb cluster mysql mysql-5.5 mysql-5.7 percona-server-5.6 percona-xtradb-cluster-5.6 mysql-5.7 mysql-8.0 mysql-8.0 mysql-8.0Operating systems Databases
    • Update to 8.0.39-0ubuntu0.20.04.1
    • Update to 8.0.39-0ubuntu0.22.04.1
    • Update to 8.0.39-0ubuntu0.24.04.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  8. CVE-2024-21176

    Medium · CVSS 5.3EPSS 0.7%No fix published

    CVE-2024-21176

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Thread Pooling). Supported versions that are affected are 8.4.0 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H).

    mysql mysql-5.5 mysql-5.7 percona-server-5.6 percona-xtradb-cluster-5.6Operating systems Databases
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  9. CVE-2024-21173

    Medium · CVSS 4.9EPSS 0.82%Fix available

    CVE-2024-21173

    Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.37 and prior and 8.4.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

    mysql mysql-5.5 mysql-5.7 percona-server-5.6 percona-xtradb-cluster-5.6 mysql-5.7 mysql-8.0 mysql-8.0 mysql-8.0Operating systems Databases
    • Update to 8.0.39-0ubuntu0.20.04.1
    • Update to 8.0.39-0ubuntu0.22.04.1
    • Update to 8.0.39-0ubuntu0.24.04.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  10. CVE-2024-21171

    Medium · CVSS 6.5EPSS 0.88%Fix available

    CVE-2024-21171

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.37 and prior and 8.4.0 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

    mysql mysql-5.5 mysql-5.7 percona-server-5.6 percona-xtradb-cluster-5.6 mysql-5.7 mysql-8.0 mysql-8.0 mysql-8.0Operating systems Databases
    • Update to 8.0.39-0ubuntu0.20.04.1
    • Update to 8.0.39-0ubuntu0.22.04.1
    • Update to 8.0.39-0ubuntu0.24.04.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  11. CVE-2024-21166

    Medium · CVSS 5.9EPSS 0.73%Fix available

    CVE-2024-21166

    Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.36 and prior and 8.3.0 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all MySQL Server accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 5.9 (Integrity and Availability impacts). CVSS Vector: (CVSS:3

    mysql mysql-5.5 mysql-5.7 percona-server-5.6 percona-xtradb-cluster-5.6 mysql-5.7 mysql-8.0 mysql-8.0 mysql-8.0Operating systems Databases
    • Update to 8.0.37-0ubuntu0.20.04.3
    • Update to 8.0.37-0ubuntu0.22.04.3
    • Update to 8.0.37-0ubuntu0.24.04.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  12. CVE-2024-21165

    Medium · CVSS 4.9EPSS 0.9%Fix available

    CVE-2024-21165

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Pluggable Auth). Supported versions that are affected are 8.0.37 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

    mysql mysql-5.5 mysql-5.7 percona-server-5.6 percona-xtradb-cluster-5.6 mysql-5.7 mysql-8.0 mysql-8.0 mysql-8.0Operating systems Databases
    • Update to 8.0.39-0ubuntu0.20.04.1
    • Update to 8.0.39-0ubuntu0.22.04.1
    • Update to 8.0.39-0ubuntu0.24.04.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  13. CVE-2024-21163

    Medium · CVSS 5.5EPSS 0.75%Fix available

    CVE-2024-21163

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.37 and prior and 8.4.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.1 Base Score 5.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N

    mysql mysql-5.5 mysql-5.7 percona-server-5.6 percona-xtradb-cluster-5.6 mysql-5.7 mysql-8.0 mysql-8.0 mysql-8.0Operating systems Databases
    • Update to 8.0.39-0ubuntu0.20.04.1
    • Update to 8.0.39-0ubuntu0.22.04.1
    • Update to 8.0.39-0ubuntu0.24.04.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  14. CVE-2024-21162

    Medium · CVSS 4.9EPSS 0.85%Fix available

    CVE-2024-21162

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.37 and prior and 8.4.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

    mysql mysql-5.5 mysql-5.7 percona-server-5.6 percona-xtradb-cluster-5.6 mysql-5.7 mysql-8.0 mysql-8.0 mysql-8.0Operating systems Databases
    • Update to 8.0.39-0ubuntu0.20.04.1
    • Update to 8.0.39-0ubuntu0.22.04.1
    • Update to 8.0.39-0ubuntu0.24.04.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  15. CVE-2024-21160

    Medium · CVSS 4.9EPSS 0.85%Fix available

    CVE-2024-21160

    Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.36 and prior and 8.3.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

    mysql mysql-5.5 mysql-5.7 percona-server-5.6 percona-xtradb-cluster-5.6 mysql-5.7 mysql-8.0 mysql-8.0 mysql-8.0Operating systems Databases
    • Update to 8.0.37-0ubuntu0.20.04.3
    • Update to 8.0.37-0ubuntu0.22.04.3
    • Update to 8.0.37-0ubuntu0.24.04.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  16. CVE-2024-21159

    Medium · CVSS 4.9EPSS 0.79%Fix available

    CVE-2024-21159

    Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.36 and prior and 8.3.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

    mysql mysql-5.5 mysql-5.7 percona-server-5.6 percona-xtradb-cluster-5.6 mysql-5.7 mysql-8.0 mysql-8.0 mysql-8.0Operating systems Databases
    • Update to 8.0.37-0ubuntu0.20.04.3
    • Update to 8.0.37-0ubuntu0.22.04.3
    • Update to 8.0.37-0ubuntu0.24.04.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  17. CVE-2024-21157

    Medium · CVSS 4.9EPSS 0.9%Fix available

    CVE-2024-21157

    Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.36 and prior and 8.4.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

    mysql mysql-5.5 mysql-5.7 percona-server-5.6 percona-xtradb-cluster-5.6 mysql-5.7 mysql-8.0 mysql-8.0 mysql-8.0Operating systems Databases
    • Update to 8.0.37-0ubuntu0.20.04.3
    • Update to 8.0.37-0ubuntu0.22.04.3
    • Update to 8.0.37-0ubuntu0.24.04.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  18. CVE-2024-21142

    Medium · CVSS 4.9EPSS 0.85%Fix available

    CVE-2024-21142

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 8.0.37 and prior and 8.4.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

    mysql mysql-5.5 mysql-5.7 percona-server-5.6 percona-xtradb-cluster-5.6 mysql-5.7 mysql-8.0 mysql-8.0 mysql-8.0Operating systems Databases
    • Update to 8.0.39-0ubuntu0.20.04.1
    • Update to 8.0.39-0ubuntu0.22.04.1
    • Update to 8.0.39-0ubuntu0.24.04.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  19. CVE-2024-21137

    Medium · CVSS 4.9EPSS 0.84%Fix available

    CVE-2024-21137

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

    mysql mysql-5.5 mysql-5.7 percona-server-5.6 percona-xtradb-cluster-5.6 mysql-5.7 mysql-8.0 mysql-8.0 mysql-8.0Operating systems Databases
    • Update to 8.0.36-0ubuntu0.20.04.1
    • Update to 8.0.36-0ubuntu0.22.04.1
    • Update to 8.0.36-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  20. CVE-2024-21135

    Medium · CVSS 4.9EPSS 0.85%Fix available

    CVE-2024-21135

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.36 and prior and 8.3.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

    mysql mysql-5.5 mysql-5.7 percona-server-5.6 percona-xtradb-cluster-5.6 mysql-5.7 mysql-8.0 mysql-8.0 mysql-8.0Operating systems Databases
    • Update to 8.0.37-0ubuntu0.20.04.3
    • Update to 8.0.37-0ubuntu0.22.04.3
    • Update to 8.0.37-0ubuntu0.24.04.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →