CVE-2023-52970

A flaw was found in MariaDB Server. This vulnerability may allow an attacker to crash the database via Item_direct_view_ref::derived_field_transformer_for_where.

Moderate-impact vulnerability in Red Hat products using affected MariaDB components: a network-reachable attacker with high privileges can trigger Item_direct_view_ref::derived_field_transformer_for_where without user interaction, causing MariaDB Server to crash and resulting in a denial of service. The current record marks MariaDB in multiple Red Hat Enterprise Linux streams and Red Hat In-Vehicle OS as affected, with some streams deferred and others delegated; Community Projects are also delegated as affected. Remediation is deferred for the affected RHEL streams because the issue is moderate severity and exploitation requires high privileges, leaving residual risk of database-service interruption for privileged network attackers. Red Hat Enterprise Linux 7 MariaDB streams are not affected because the vulnerable code is not present.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.