MariaDB Server vulnerabilities

MariaDB server from 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2 RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the FILE privilege could write startup dot-files such as .bash_profile into $HOME, which could execute when an administrator opened a login shell for the mysql account. Debian packages are not affected because they use /nonexistent as the account home.

A vulnerability in MariaDB Server allows execution of arbitrary shell commands embedded in the joiner node name when `wsrep_notify_cmd` is enabled. Affected versions: 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1.

MariaDB server versions from 10.6.1 to 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2 have a vulnerability in the mysql_json plugin that assumes imported MySQL tables contain valid binary JSON. A specially crafted table with invalid JSON can cause out-of-bounds reads, information disclosure, or server crash.

MariaDB server versions from 10.6.1 to 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2 have a vulnerability in the qc_info plugin that can be confused by a query containing embedded null bytes. Reading information_schema.query_cache_info after such a query could access data beyond the end of a heap-allocated buffer, potentially disclosing adjacent memory or crashing the server.

MariaDB server from 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2 contains a vulnerability in the CONNECT engine's DOS table type where an incorrect boundary check permits a one-byte null write beyond a stack buffer at an attacker-controlled offset. An authenticated user able to use the CONNECT engine could cause a crash and potentially remote code execution.

MariaDB server versions from 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1 had an issue with not checking for /../ in the path when unpacking the archive. A specially crafted archive could have caused mbstream to create files outside of the target-dir path.

In MariaDB versions from 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, a user with EXECUTE access to a stored routine could see the routine definition even without SHOW CREATE ROUTINE privilege. This issue has been patched in versions 11.4.11, 11.8.7, and 12.3.2.

In MariaDB Server before versions 11.4.10, 11.5.x-11.8.x before 11.8.6, and 12.x before 12.2.2, a vulnerability was found where a large packet can crash the server if the caching_sha2_password authentication plugin is installed and some user accounts are configured to use it. The issue is due to alloca usage in sha256_crypt_r.