CVE-2024-21237

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Group Replication GCS). Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and 9.0.1 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server. CVSS 3.1 Base Score 2.2 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L).

A low severity vulnerability exists in the Group Replication GCS (Group Communication System) component of Oracle MySQL Server, affecting MySQL 8.0.39 and prior, 8.4.2 and prior, and 9.0.1 and prior. The flaw is difficult to exploit and requires a highly privileged attacker with network access via multiple protocols; a successful attack can result in an unauthorized partial denial of service of MySQL Server, with no impact on confidentiality or integrity. Red Hat Enterprise Linux 8, 9, and 10, and Fedora, ship affected mysql packages and their affected streams are marked as affected, with fixes pursued through the delegated update process for each affected stream. Red Hat rates this flaw as Low severity, matching the upstream Oracle assessment, with a CVSS 3.1 base score of 2.2 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.