Vulnerability in the MySQL Server product of Oracle MySQL (component: Client: mysqldump). Supported versions that are affected are 8.0.36 and prior and 8.3.0 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server accessible data as well as unauthorized read access to a subset of MySQL Server accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L).

The version of mariadb / mysql installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-21096 advisory.

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Client: mysqldump). Supported     versions that are affected are 8.0.36 and prior and 8.3.0 and prior. Difficult to exploit vulnerability     allows unauthenticated attacker with logon to the infrastructure where MySQL Server executes to compromise     MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete     access to some of MySQL Server accessible data as well as unauthorized read access to a subset of MySQL     Server accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of     MySQL Server. (CVE-2024-21096)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-3891 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3891-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                      Otto Keklinen     September 18, 2024                            https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : mariadb-10.5     Version        : 1:10.5.26-0+deb11u2     CVE ID         : CVE-2024-21096     Debian Bug     : 1069189 1015293

    A vulnerability was discovered in MariaDB, a SQL database server     compatible with MySQL. An attacker could generate a malicious dump     file which could execute shell commands from the MariaDB client.

    The fix may cause a compatibility issue with older MariaDB and MySQL     clients, with existing workarounds, as detailed at:
    https://mariadb.org/mariadb-dump-file-compatibility-change/

    This updates also includes bugfixes through the 10.5 maintenance     branch, as detailed at:
    https://mariadb.com/kb/en/mariadb-10-5-24-release-notes/     https://mariadb.com/kb/en/mariadb-10-5-25-release-notes/     https://mariadb.com/kb/en/mariadb-10-5-26-release-notes/

    For Debian 11 bullseye, this problem has been fixed in version     1:10.5.26-0+deb11u2.

    We recommend that you upgrade your mariadb-10.5 packages.

    For the detailed security status of mariadb-10.5 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/mariadb-10.5

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:3018-1 advisory.

    - Updated to 10.5.26

    - Updated to 10.5.25:
      - CVE-2024-21096: Fixed a vulnerability that would allow unauthenticated attacker with logon to the     infrastructure where MySQL Server executes to compromise MySQL Server. (bsc#1225983)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-698 advisory.

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Client: mysqldump).  Supported     versions that are affected are 8.0.36 and prior and  8.3.0 and prior. Difficult to exploit vulnerability     allows unauthenticated attacker with logon to the infrastructure where MySQL Server executes to compromise     MySQL Server.  Successful attacks of this vulnerability can result in  unauthorized update, insert or     delete access to some of MySQL Server accessible data as well as  unauthorized read access to a subset of     MySQL Server accessible data and unauthorized ability to cause a partial denial of service (partial DOS)     of MySQL Server. CVSS 3.1 Base Score 4.9 (Confidentiality, Integrity and Availability impacts).  CVSS     Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L). (CVE-2024-21096)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of mariadb installed on the remote host is prior to 10.5.25-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2MARIADB10.5-2024-006 advisory.

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Client: mysqldump).  Supported     versions that are affected are 8.0.36 and prior and  8.3.0 and prior. Difficult to exploit vulnerability     allows unauthenticated attacker with logon to the infrastructure where MySQL Server executes to compromise     MySQL Server.  Successful attacks of this vulnerability can result in  unauthorized update, insert or     delete access to some of MySQL Server accessible data as well as  unauthorized read access to a subset of     MySQL Server accessible data and unauthorized ability to cause a partial denial of service (partial DOS)     of MySQL Server. CVSS 3.1 Base Score 4.9 (Confidentiality, Integrity and Availability impacts).  CVSS     Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L). (CVE-2024-21096)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 23.10 / 24.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-6839-1 advisory.

    A security issue was discovered in MariaDB and this update includes new upstream MariaDB versions to fix     the issue.

    MariaDB has been updated to 10.6.18 in Ubuntu 22.04 LTS and to 10.11.8 in Ubuntu 23.10 and Ubuntu 24.04     LTS.

    In addition to security fixes, the updated packages contain bug fixes, new features, and possibly     incompatible changes.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2024-d61bffd77f advisory.

    **MariaDB 10.5.25 & Galera 26.4.18**

    Release notes:

        https://mariadb.com/kb/en/mariadb-10-5-25-release-notes/

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:2032-1 advisory.

    - CVE-2024-21096: Fixed mysqldump unspecified vulnerability (bsc#1225983).

    - Update to 10.11.8.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:1985-1 advisory.

    - CVE-2024-21096: Fixed mysqldump unspecified vulnerability (bsc#1225983).
    - CVE-2023-22084: Fixed a vulnerability allows high privileged attacker with network access via multiple     protocols to compromise the server (bsc#1217405).

    - Update to 10.6.18.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.10 / 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6823-1 advisory.

    Multiple security issues were discovered in MySQL and this update includes new upstream MySQL versions to     fix these issues.

    MySQL has been updated to 8.0.37 in Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 23.10, and Ubuntu 24.04     LTS.

    In addition to security fixes, the updated packages contain bug fixes, new features, and possibly     incompatible changes.

    Please see the following for more information:

    https://dev.mysql.com/doc/relnotes/mysql/8.0/en/news-8-0-37.html https://www.oracle.com/security-     alerts/cpuapr2024.html

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2024-6ea93e629b advisory.

    **MariaDB 10.11.8 & Galera 26.4.18**

    Release notes:

        https://mariadb.com/kb/en/mariadb-10-11-7-release-notes/         https://mariadb.com/kb/en/mariadb-10-11-8-release-notes/

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of MariaDB installed on the remote host is prior to 11.5.1. It is, therefore, affected by a vulnerability as referenced in the mariadb-1151-release-notes advisory.

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Client: mysqldump). Supported     versions that are affected are 8.0.36 and prior and 8.3.0 and prior. Difficult to exploit vulnerability     allows unauthenticated attacker with logon to the infrastructure where MySQL Server executes to compromise     MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete     access to some of MySQL Server accessible data as well as unauthorized read access to a subset of MySQL     Server accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of     MySQL Server. (CVE-2024-21096)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of MariaDB installed on the remote host is prior to 11.4.2. It is, therefore, affected by a vulnerability as referenced in the mariadb-1142-release-notes advisory.

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Client: mysqldump). Supported     versions that are affected are 8.0.36 and prior and 8.3.0 and prior. Difficult to exploit vulnerability     allows unauthenticated attacker with logon to the infrastructure where MySQL Server executes to compromise     MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete     access to some of MySQL Server accessible data as well as unauthorized read access to a subset of MySQL     Server accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of     MySQL Server. (CVE-2024-21096)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of mariadb installed on the remote host is prior to 10.11.8 / 10.5.25. It is, therefore, affected by a vulnerability as referenced in the SSA:2024-141-01 advisory.

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Client: mysqldump). Supported     versions that are affected are 8.0.36 and prior and 8.3.0 and prior. Difficult to exploit vulnerability     allows unauthenticated attacker with logon to the infrastructure where MySQL Server executes to compromise     MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete     access to some of MySQL Server accessible data as well as unauthorized read access to a subset of MySQL     Server accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of     MySQL Server. (CVE-2024-21096)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of MariaDB installed on the remote host is prior to 11.2.4. It is, therefore, affected by a vulnerability as referenced in the mdb-1124-rn advisory.

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Client: mysqldump). Supported     versions that are affected are 8.0.36 and prior and 8.3.0 and prior. Difficult to exploit vulnerability     allows unauthenticated attacker with logon to the infrastructure where MySQL Server executes to compromise     MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete     access to some of MySQL Server accessible data as well as unauthorized read access to a subset of MySQL     Server accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of     MySQL Server. (CVE-2024-21096)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of MariaDB installed on the remote host is prior to 10.6.18. It is, therefore, affected by a vulnerability as referenced in the mdb-10618-rn advisory.

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Client: mysqldump). Supported     versions that are affected are 8.0.36 and prior and 8.3.0 and prior. Difficult to exploit vulnerability     allows unauthenticated attacker with logon to the infrastructure where MySQL Server executes to compromise     MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete     access to some of MySQL Server accessible data as well as unauthorized read access to a subset of MySQL     Server accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of     MySQL Server. (CVE-2024-21096)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of MariaDB installed on the remote host is prior to 10.11.8. It is, therefore, affected by a vulnerability as referenced in the mdb-10-11-8-rn advisory.

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Client: mysqldump). Supported     versions that are affected are 8.0.36 and prior and 8.3.0 and prior. Difficult to exploit vulnerability     allows unauthenticated attacker with logon to the infrastructure where MySQL Server executes to compromise     MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete     access to some of MySQL Server accessible data as well as unauthorized read access to a subset of MySQL     Server accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of     MySQL Server. (CVE-2024-21096)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of MariaDB installed on the remote host is prior to 11.1.5. It is, therefore, affected by a vulnerability as referenced in the mariadb-1115-release-notes advisory.

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Client: mysqldump). Supported     versions that are affected are 8.0.36 and prior and 8.3.0 and prior. Difficult to exploit vulnerability     allows unauthenticated attacker with logon to the infrastructure where MySQL Server executes to compromise     MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete     access to some of MySQL Server accessible data as well as unauthorized read access to a subset of MySQL     Server accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of     MySQL Server. (CVE-2024-21096)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of MariaDB installed on the remote host is prior to 11.0.6. It is, therefore, affected by a vulnerability as referenced in the mariadb-1106-release-notes advisory.

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Client: mysqldump). Supported     versions that are affected are 8.0.36 and prior and 8.3.0 and prior. Difficult to exploit vulnerability     allows unauthenticated attacker with logon to the infrastructure where MySQL Server executes to compromise     MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete     access to some of MySQL Server accessible data as well as unauthorized read access to a subset of MySQL     Server accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of     MySQL Server. (CVE-2024-21096)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of MariaDB installed on the remote host is prior to 10.5.25. It is, therefore, affected by a vulnerability as referenced in the mdb-10525-rn advisory.

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Client: mysqldump). Supported     versions that are affected are 8.0.36 and prior and 8.3.0 and prior. Difficult to exploit vulnerability     allows unauthenticated attacker with logon to the infrastructure where MySQL Server executes to compromise     MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete     access to some of MySQL Server accessible data as well as unauthorized read access to a subset of MySQL     Server accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of     MySQL Server. (CVE-2024-21096)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The versions of MySQL Server installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2024 CPU advisory.

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Packaging (OpenSSL)).
    Supported versions that are affected are 8.0.36 and prior and 8.3.0 and prior. Difficult to exploit vulnerability     allows unauthenticated attacker with network access via TLS to compromise MySQL Server. Successful attacks of this     vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete     DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible     data. (CVE-2023-6129)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that     are affected are 8.0.34 and prior and 8.3.0 and prior. Easily exploitable vulnerability allows high privileged     attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this     vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS)     of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible     data. (CVE-2024-21015)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions     that are affected are 8.0.36 and prior and 8.3.0 and prior. Easily exploitable vulnerability allows high     privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of     this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete     DOS) of MySQL Server. (CVE-2024-20998)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of MySQL Server installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2024 CPU advisory.

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Packaging (OpenSSL)).
    Supported versions that are affected are 8.0.36 and prior and 8.3.0 and prior. Difficult to exploit vulnerability     allows unauthenticated attacker with network access via TLS to compromise MySQL Server. Successful attacks of this     vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete     DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible     data. (CVE-2023-6129)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that     are affected are 8.0.34 and prior and 8.3.0 and prior. Easily exploitable vulnerability allows high privileged     attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this     vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS)     of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible     data. (CVE-2024-21015)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema). Supported     versions that are affected are 8.0.36 and prior and 8.3.0 and prior. Difficult to exploit vulnerability     allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful     attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash     (complete DOS) of MySQL Server. (CVE-2024-20994)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
209584	CBL Mariner 2.0 Security Update: mariadb / mysql (CVE-2024-21096)	Nessus	MarinerOS Local Security Checks	medium
207380	Debian dla-3891 : libmariadb-dev - security update	Nessus	Debian Local Security Checks	medium
206251	SUSE SLES15 Security Update : mariadb (SUSE-SU-2024:3018-1)	Nessus	SuSE Local Security Checks	medium
205108	Amazon Linux 2023 : mariadb105, mariadb105-backup, mariadb105-common (ALAS2023-2024-698)	Nessus	Amazon Linux Local Security Checks	medium
202979	Amazon Linux 2 : mariadb (ALASMARIADB10.5-2024-006)	Nessus	Amazon Linux Local Security Checks	medium
200739	Ubuntu 22.04 LTS / 23.10 / 24.04 LTS : MariaDB vulnerability (USN-6839-1)	Nessus	Ubuntu Local Security Checks	medium
200670	Fedora 39 : galera / mariadb (2024-d61bffd77f)	Nessus	Fedora Local Security Checks	medium
200638	SUSE SLES15 / openSUSE 15 Security Update : mariadb (SUSE-SU-2024:2032-1)	Nessus	SuSE Local Security Checks	medium
200396	SUSE SLES15 / openSUSE 15 Security Update : mariadb (SUSE-SU-2024:1985-1)	Nessus	SuSE Local Security Checks	medium
200259	Ubuntu 20.04 LTS / 22.04 LTS / 23.10 / 24.04 LTS : MySQL vulnerabilities (USN-6823-1)	Nessus	Ubuntu Local Security Checks	medium
200240	Fedora 40 : galera / mariadb10.11 (2024-6ea93e629b)	Nessus	Fedora Local Security Checks	medium
198050	MariaDB 11.5.0 < 11.5.1	Nessus	Databases	medium
198049	MariaDB 11.4.0 < 11.4.2	Nessus	Databases	medium
197520	Slackware Linux 15.0 / current mariadb Vulnerability (SSA:2024-141-01)	Nessus	Slackware Local Security Checks	medium
197213	MariaDB 11.2.0 < 11.2.4	Nessus	Databases	medium
197199	MariaDB 10.6.0 < 10.6.18	Nessus	Databases	medium
197197	MariaDB 10.11.0 < 10.11.8	Nessus	Databases	medium
197196	MariaDB 11.1.0 < 11.1.5	Nessus	Databases	medium
197195	MariaDB 11.0.0 < 11.0.6	Nessus	Databases	medium
197194	MariaDB 10.5.0 < 10.5.25	Nessus	Databases	medium
193568	Oracle MySQL Server 8.0.x < 8.0.37 (July 2024 CPU)	Nessus	Databases	medium
193567	Oracle MySQL Server 8.x < 8.4.0 (July 2024 CPU)	Nessus	Databases	medium

Detections

Analytics

CVE-2024-21096

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium