CVE-2024-21247

Vulnerability in the MySQL Client product of Oracle MySQL (component: Client: mysqldump). Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and 9.0.1 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Client. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Client accessible data as well as unauthorized read access to a subset of MySQL Client accessible data. CVSS 3.1 Base Score 3.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N).

A LOW severity vulnerability was found in the mysqldump component of the Oracle MySQL Client. This easily exploitable flaw allows a high-privileged attacker with network access via multiple protocols to compromise the MySQL Client, and successful attacks can result in unauthorized update, insert, or delete access to some of the data accessible to the MySQL Client, as well as unauthorized read access to a subset of that data. Upstream, the affected versions are MySQL Client 8.0.39 and prior, 8.4.2 and prior, and 9.0.1 and prior. Within the Red Hat portfolio, Red Hat Enterprise Linux 8 (mysql:8.0), Red Hat Enterprise Linux 9 (mysql), Red Hat Enterprise Linux 10 (mysql8.4), and Fedora (mysql8.0) include affected versions of this component and are marked as affected; because these components are maintained through a delegated maintenance process, a fix is being pursued by the responsible maintainers. The Red Hat severity rating of LOW (CVSS 3.1 base score 3.8, CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N) is consistent with the upstream Oracle assessment, so there is no meaningful difference in severity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Update to a version of the MySQL Client that contains the fix for this issue, as specified in Oracle's October 2024 Critical Patch Update advisory: https://www.oracle.com/security-alerts/cpuoct2024.html