CVE-2021-27928 Code injection in n/a
A database SUPER user can execute OS commands via eval injection in MariaDB by modifying specific configuration parameters.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-27928?
CVE-2021-27928 is a high-severity code injection vulnerability in Debian Debian Linux, published on 19 Mar 2021. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A remote code execution issue was discovered in MariaDB 10.2 before 10.2.37, 10.3 before 10.3.28, 10.4 before 10.4.18, and 10.5 before 10.5.9; Percona Server through 2021-03-03; and the wsrep patch through 2021-03-03 for MySQL. An untrusted search path leads to eval injection, in which a database SUPER user can execute OS commands after modifying wsrep_provider and wsrep_notify_cmd. NOTE: this does not affect an Oracle product.
Weakness: CWE-94
Which versions are affected by CVE-2021-27928?
3 open source packages ship an affected version, including mariadb, mariadb-min and mysql-client. It affects 4 products.
| Package | Affected | Fixed in |
|---|---|---|
mariadb Bitnami | From 10.2.0 | 10.2.37, 10.3.28, 10.4.18, 10.5.9 |
mariadb-min Bitnami | From 10.2.0 | 10.2.37, 10.3.28, 10.4.18, 10.5.9 |
mysql-client Bitnami | From 10.2.0 | 10.2.37, 10.3.28, 10.4.18, 10.5.9 |
Linux distribution packages (37)
Judy AlmaLinux:8 | All versions | 1.0.5-18.module_el8.3.0+2028+5e3224e9 |
Judy AlmaLinux:8 | All versions | 1.0.5-18.module_el8.5.0+2632+14ced695 |
Judy AlmaLinux:8 | All versions | 1.0.5-18.module_el8.6.0+2761+593e5e59 |
Judy AlmaLinux:8 | All versions | 1.0.5-18.module_el8.6.0+2867+72759d2f |
Judy-devel AlmaLinux:8 | All versions | 1.0.5-18.module_el8.3.0+2028+5e3224e9 |
Judy-devel AlmaLinux:8 | All versions | 1.0.5-18.module_el8.6.0+2867+72759d2f |
Judy-devel AlmaLinux:8 | All versions | 1.0.5-18.module_el8.6.0+3072+3c630e87 |
asio-devel AlmaLinux:8 | All versions | 1.10.8-7.module_el8.6.0+2867+72759d2f |
asio-devel AlmaLinux:8 | All versions | 1.10.8-7.module_el8.6.0+3072+3c630e87 |
galera AlmaLinux:8 | All versions | 25.3.32-1.module_el8.3.0+2177+7adc332a |
mariadb AlmaLinux:8 | All versions | 3:10.3.28-1.module_el8.3.0+2177+7adc332a |
mariadb-backup AlmaLinux:8 | All versions | 3:10.3.28-1.module_el8.3.0+2177+7adc332a |
mariadb-common AlmaLinux:8 | All versions | 3:10.3.28-1.module_el8.3.0+2177+7adc332a |
mariadb-devel AlmaLinux:8 | All versions | 3:10.3.28-1.module_el8.3.0+2177+7adc332a |
mariadb-embedded AlmaLinux:8 | All versions | 3:10.3.28-1.module_el8.3.0+2177+7adc332a |
mariadb-embedded-devel AlmaLinux:8 | All versions | 3:10.3.28-1.module_el8.3.0+2177+7adc332a |
mariadb-errmsg AlmaLinux:8 | All versions | 3:10.3.28-1.module_el8.3.0+2177+7adc332a |
mariadb-gssapi-server AlmaLinux:8 | All versions | 3:10.3.28-1.module_el8.3.0+2177+7adc332a |
mariadb-oqgraph-engine AlmaLinux:8 | All versions | 3:10.3.28-1.module_el8.3.0+2177+7adc332a |
mariadb-server AlmaLinux:8 | All versions | 3:10.3.28-1.module_el8.3.0+2177+7adc332a |
mariadb-server-galera AlmaLinux:8 | All versions | 3:10.3.28-1.module_el8.3.0+2177+7adc332a |
mariadb-server-utils AlmaLinux:8 | All versions | 3:10.3.28-1.module_el8.3.0+2177+7adc332a |
mariadb-test AlmaLinux:8 | All versions | 3:10.3.28-1.module_el8.3.0+2177+7adc332a |
Judy Red Hat:enterprise_linux:8::appstream | All versions | 0:1.0.5-18.module+el8+2765+cfa4f87b |
Judy-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:1.0.5-18.module+el8+2765+cfa4f87b |
Judy-debugsource Red Hat:enterprise_linux:8::appstream | All versions | 0:1.0.5-18.module+el8+2765+cfa4f87b |
galera Red Hat:enterprise_linux:8::appstream | All versions | 0:25.3.32-1.module+el8.3.0+10472+7adc332a |
galera-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:25.3.32-1.module+el8.3.0+10472+7adc332a |
galera-debugsource Red Hat:enterprise_linux:8::appstream | All versions | 0:25.3.32-1.module+el8.3.0+10472+7adc332a |
mariadb Red Hat:enterprise_linux:8::appstream | All versions | 3:10.3.28-1.module+el8.3.0+10472+7adc332a |
mariadb-backup Red Hat:enterprise_linux:8::appstream | All versions | 3:10.3.28-1.module+el8.3.0+10472+7adc332a |
mariadb-backup-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 3:10.3.28-1.module+el8.3.0+10472+7adc332a |
mariadb-common Red Hat:enterprise_linux:8::appstream | All versions | 3:10.3.28-1.module+el8.3.0+10472+7adc332a |
mariadb-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 3:10.3.28-1.module+el8.3.0+10472+7adc332a |
mariadb-debugsource Red Hat:enterprise_linux:8::appstream | All versions | 3:10.3.28-1.module+el8.3.0+10472+7adc332a |
mariadb-devel Red Hat:enterprise_linux:8::appstream | All versions | 3:10.3.28-1.module+el8.3.0+10472+7adc332a |
mariadb-embedded Red Hat:enterprise_linux:8::appstream | All versions | 3:10.3.28-1.module+el8.3.0+10472+7adc332a |
Products include Debian Debian Linux, Galeracluster Wsrep, Mariadb Mariadb, Percona Percona Server.
How do I fix CVE-2021-27928?
Upgrade mariadb to a fixed version for your release line: 10.2.37, 10.3.28, 10.4.18 or 10.5.9.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2021-27928 being exploited?
There is no known exploitation of CVE-2021-27928 in the wild and no public exploit code.
Public exploit code: 1 Exploit-DB entry and 3 proofs of concept on GitHub.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as ALPINE-CVE-2021-27928, ALSA-2021:1242, BIT-mariadb-2021-27928, BIT-mariadb-min-2021-27928, BIT-mysql-client-2021-27928, DEBIAN-CVE-2021-27928 and 11 more.