Security update for mariadb

Announcement ID:	SUSE-SU-2022:3391-1
Rating:	important
References:	bsc#1200105 bsc#1201161 bsc#1201162 bsc#1201163 bsc#1201164 bsc#1201165 bsc#1201166 bsc#1201167 bsc#1201168 bsc#1201169 bsc#1201170 bsc#1202863
Cross-References:	CVE-2022-32081 CVE-2022-32082 CVE-2022-32083 CVE-2022-32084 CVE-2022-32085 CVE-2022-32086 CVE-2022-32087 CVE-2022-32088 CVE-2022-32089 CVE-2022-32091 CVE-2022-38791
CVSS scores:	CVE-2022-32081 ( SUSE ): 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CVE-2022-32081 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-32082 ( SUSE ): 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CVE-2022-32082 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-32083 ( SUSE ): 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CVE-2022-32083 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-32084 ( SUSE ): 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CVE-2022-32084 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-32085 ( SUSE ): 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CVE-2022-32085 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-32086 ( SUSE ): 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CVE-2022-32086 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-32087 ( SUSE ): 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CVE-2022-32087 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-32088 ( SUSE ): 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CVE-2022-32088 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-32089 ( SUSE ): 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CVE-2022-32089 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-32091 ( SUSE ): 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CVE-2022-32091 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-38791 ( SUSE ): 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-38791 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected Products:	Galera for Ericsson 15 SP3 openSUSE Leap 15.3 Server Applications Module 15-SP3 SUSE Linux Enterprise Desktop 15 SP3 SUSE Linux Enterprise High Performance Computing 15 SP3 SUSE Linux Enterprise Micro 5.1 SUSE Linux Enterprise Micro 5.2 SUSE Linux Enterprise Real Time 15 SP3 SUSE Linux Enterprise Server 15 SP3 SUSE Linux Enterprise Server 15 SP3 Business Critical Linux 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15 SP3 SUSE Manager Proxy 4.2 SUSE Manager Retail Branch Server 4.2 SUSE Manager Server 4.2 SUSE Package Hub 15 15-SP3

An update that solves 11 vulnerabilities and has one security fix can now be installed.

Description:

This update for mariadb fixes the following issues:

Update to 10.5.17:

• CVE-2022-32082: Fixed assertion failure at table->get_ref_count() == 0 in dict0dict.cc (bsc#1201162).
• CVE-2022-32089: Fixed segmentation fault via the component st_select_lex_unit::exclude_level (bsc#1201169).
• CVE-2022-32081: Fixed use-after-poison in prepare_inplace_add_virtual at /storage/innobase/handler/handler0alter.cc (bsc#1201161).
• CVE-2022-32091: Fixed use-after-poison in __interceptor_memset at /libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc (bsc#1201170).
• CVE-2022-32084: Fixed segmentation fault via the component sub_select (bsc#1201164).

• CVE-2022-38791: Fixed deadlock in compress_write in extra/mariabackup/ds_compress.cc (bsc#1202863).

• CVE-2022-32088: Fixed segmentation fault via the component Exec_time_tracker::get_loops/Filesort_tracker::report_use/filesort (bsc#1201168).

• CVE-2022-32087: Fixed segmentation fault via the component Item_args::walk_args (bsc#1201167).
• CVE-2022-32086: Fixed segmentation fault via the component Item_field::fix_outer_field (bsc#1201166).
• CVE-2022-32085: Fixed segmentation fault via the component Item_func_in::cleanup/Item::cleanup_processor (bsc#1201165).
• CVE-2022-32083: Fixed segmentation fault via the component Item_subselect::init_expr_cache_tracker (bsc#1201163).

Bugfixes:

• Fixed mysql-systemd-helper being unaware of custom group (bsc#1200105).

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

• openSUSE Leap 15.3
  zypper in -t patch SUSE-2022-3391=1
• SUSE Package Hub 15 15-SP3
  zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP3-2022-3391=1
• Server Applications Module 15-SP3
  zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP3-2022-3391=1
• Galera for Ericsson 15 SP3
  zypper in -t patch SUSE-SLE-Product-SLES-15-SP3-ERICSSON-2022-3391=1

Package List:

• openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64 i586)
  • libmariadbd-devel-10.5.17-150300.3.21.1
  • mariadb-client-10.5.17-150300.3.21.1
  • mariadb-test-debuginfo-10.5.17-150300.3.21.1
  • mariadb-debugsource-10.5.17-150300.3.21.1
  • mariadb-tools-10.5.17-150300.3.21.1
  • libmariadbd19-debuginfo-10.5.17-150300.3.21.1
  • mariadb-rpm-macros-10.5.17-150300.3.21.1
  • mariadb-test-10.5.17-150300.3.21.1
  • mariadb-debuginfo-10.5.17-150300.3.21.1
  • mariadb-galera-10.5.17-150300.3.21.1
  • mariadb-bench-10.5.17-150300.3.21.1
  • mariadb-bench-debuginfo-10.5.17-150300.3.21.1
  • mariadb-10.5.17-150300.3.21.1
  • mariadb-client-debuginfo-10.5.17-150300.3.21.1
  • libmariadbd19-10.5.17-150300.3.21.1
  • mariadb-tools-debuginfo-10.5.17-150300.3.21.1
• openSUSE Leap 15.3 (noarch)
  • mariadb-errormessages-10.5.17-150300.3.21.1
• SUSE Package Hub 15 15-SP3 (aarch64 ppc64le s390x x86_64)
  • mariadb-galera-10.5.17-150300.3.21.1
• Server Applications Module 15-SP3 (aarch64 ppc64le s390x x86_64)
  • libmariadbd-devel-10.5.17-150300.3.21.1
  • mariadb-tools-10.5.17-150300.3.21.1
  • libmariadbd19-debuginfo-10.5.17-150300.3.21.1
  • mariadb-debuginfo-10.5.17-150300.3.21.1
  • libmariadbd19-10.5.17-150300.3.21.1
  • mariadb-debugsource-10.5.17-150300.3.21.1
  • mariadb-10.5.17-150300.3.21.1
  • mariadb-client-debuginfo-10.5.17-150300.3.21.1
  • mariadb-client-10.5.17-150300.3.21.1
  • mariadb-tools-debuginfo-10.5.17-150300.3.21.1
• Server Applications Module 15-SP3 (noarch)
  • mariadb-errormessages-10.5.17-150300.3.21.1
• Galera for Ericsson 15 SP3 (x86_64)
  • mariadb-galera-10.5.17-150300.3.21.1

References:

• https://www.suse.com/security/cve/CVE-2022-32081.html
• https://www.suse.com/security/cve/CVE-2022-32082.html
• https://www.suse.com/security/cve/CVE-2022-32083.html
• https://www.suse.com/security/cve/CVE-2022-32084.html
• https://www.suse.com/security/cve/CVE-2022-32085.html
• https://www.suse.com/security/cve/CVE-2022-32086.html
• https://www.suse.com/security/cve/CVE-2022-32087.html
• https://www.suse.com/security/cve/CVE-2022-32088.html
• https://www.suse.com/security/cve/CVE-2022-32089.html
• https://www.suse.com/security/cve/CVE-2022-32091.html
• https://www.suse.com/security/cve/CVE-2022-38791.html
• https://bugzilla.suse.com/show_bug.cgi?id=1200105
• https://bugzilla.suse.com/show_bug.cgi?id=1201161
• https://bugzilla.suse.com/show_bug.cgi?id=1201162
• https://bugzilla.suse.com/show_bug.cgi?id=1201163
• https://bugzilla.suse.com/show_bug.cgi?id=1201164
• https://bugzilla.suse.com/show_bug.cgi?id=1201165
• https://bugzilla.suse.com/show_bug.cgi?id=1201166
• https://bugzilla.suse.com/show_bug.cgi?id=1201167
• https://bugzilla.suse.com/show_bug.cgi?id=1201168
• https://bugzilla.suse.com/show_bug.cgi?id=1201169
• https://bugzilla.suse.com/show_bug.cgi?id=1201170
• https://bugzilla.suse.com/show_bug.cgi?id=1202863