CVE-2021-35583 Denial of service in MySQL Server

High 7.5 Published 20 Oct 2021 Updated 25 Sep 2024

Unauthenticated attackers can cause a complete denial of service on MySQL Server via network access, requiring immediate patching.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2021-35583?

CVE-2021-35583 is a high-severity denial of service vulnerability in Netapp Oncommand Insight, published on 20 Oct 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Windows). Supported versions that are affected are 8.0.25 and prior. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

Which versions are affected by CVE-2021-35583?

It affects 3 products.

Products include Netapp Oncommand Insight, Netapp Snapcenter, Oracle Mysql Server.

How do I fix CVE-2021-35583?

Apply the vendor's patch.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2021-35583 being exploited?

There is no known exploitation of CVE-2021-35583 in the wild and no public exploit code.

All Netapp Oncommand Insight vulnerabilities

Sources

Also known as GHSA-73j5-x974-cvx7, UBUNTU-CVE-2021-35583.