CVE-2021-2030:
MySQL Server Optimizer Vulnerability Leading to Denial of Service
Score
A numerical rating that indicates how dangerous this vulnerability is.
4.9Medium- Published Date:Jan 20, 2021
- CISA KEV Date:*No Data*
- Industries Affected:20
Threat Predictions
- EPSS Score:0.2
- EPSS Percentile:42%
Exploitability
- Score:1.2
- Attack Vector:NETWORK
- Attack Complexity:LOW
- Privileges Required:HIGH
- User Interaction:NONE
- Scope:UNCHANGED
Impact
- Score:3.6
- Confidentiality Impact:NONE
- Integrity Impact:NONE
- Availability Impact:HIGH
Description Preview
MySQL Server Optimizer Vulnerability Leading to Denial of Service
Overview
This vulnerability exists in the Optimizer component of MySQL Server versions 8.0.21 and prior. An attacker with high privileges and network access can exploit this vulnerability through multiple protocols to cause the MySQL Server to hang or crash repeatedly. The vulnerability is considered easily exploitable and primarily affects the availability of the MySQL service without compromising confidentiality or integrity. According to the CVSS vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H), this vulnerability requires network access, is low complexity to exploit, requires high privileges, needs no user interaction, and has a high impact on availability.
Remediation
- To address this vulnerability, system administrators should:
- 1. Upgrade MySQL Server to version 8.0.22 or later, which contains patches for this vulnerability.
- 2. Apply the security updates provided in Oracle's January 2021 Critical Patch Update.
- 3. Limit network access to MySQL Server instances to trusted hosts and networks.
- 4. Implement proper privilege management to restrict high-privilege access to trusted users only.
- 5. Monitor MySQL Server logs for potential exploitation attempts or unexpected crashes.
- 6. Consider implementing a database firewall or similar security measures to provide additional protection.
References
- 1. Oracle Critical Patch Update Advisory - January 2021:
- https://www.oracle.com/security-alerts/cpujan2021.html
- 2. NetApp Security Advisory NTAP-20210219-0003:
- https://security.netapp.com/advisory/ntap-20210219-0003/
- 3. Gentoo Linux Security Advisory GLSA-202105-27:
- https://security.gentoo.org/glsa/202105-27
- 4. CVSS 3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H (Base Score: 4.9)
Industries Affected
Below is a list of industries most commonly impacted or potentially at risk based on intelligence.
