Oracle MySQL Server up to 5.7.26/8.0.15 cURL memory corruption

Summaryinfo

A vulnerability was found in Oracle MySQL Server up to 5.7.26/8.0.15 and classified as very critical. This affects an unknown function of the component cURL. Executing a manipulation can lead to memory corruption. This vulnerability appears as CVE-2019-3822. The attack may be performed from remote. There is no available exploit. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in Oracle MySQL Server up to 5.7.26/8.0.15 (Database Software). It has been declared as very critical. This vulnerability affects an unknown code of the component cURL. The manipulation with an unknown input leads to a memory corruption vulnerability. The CWE definition for the vulnerability is CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. As an impact it is known to affect confidentiality, integrity, and availability.

The bug was discovered 02/06/2019. The weakness was presented 07/16/2019 as Oracle Critical Patch Update Advisory - Juli 2019 as confirmed advisory (Website). The advisory is available at oracle.com. This vulnerability was named CVE-2019-3822 since 01/03/2019. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. The technical details are unknown and an exploit is not available. The structure of the vulnerability defines a possible price range of USD at the moment (estimation calculated on 05/20/2025).

The vulnerability was handled as a non-public zero-day exploit for at least 160 days. During that time the estimated underground price was around $25k-$100k. The vulnerability scanner Nessus provides a plugin with the ID 236591 (Alibaba Cloud Linux 3 : 0078: curl (ALINUX3-SA-2021:0078)), which helps to determine the existence of the flaw in a target environment. The commercial vulnerability scanner Qualys is able to test this issue with plugin 277608 (Fedora Security Update for curl (FEDORA-2019-43489941ff)).

Upgrading eliminates this vulnerability. A possible mitigation has been published immediately after the disclosure of the vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (236591). See VDB-130618, VDB-133589, VDB-133491 and VDB-133762 for similar entries. If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Database Software

Vendor

• Oracle

Name

• MySQL Server

Version

• 5.7.0
• 5.7.1
• 5.7.2
• 5.7.3
• 5.7.4
• 5.7.5
• 5.7.6
• 5.7.7
• 5.7.8
• 5.7.9
• 5.7.10
• 5.7.11
• 5.7.12
• 5.7.13
• 5.7.14
• 5.7.15
• 5.7.16
• 5.7.17
• 5.7.18
• 5.7.19
• 5.7.20
• 5.7.21
• 5.7.22
• 5.7.23
• 5.7.24
• 5.7.25
• 5.7.26
• 8.0.0
• 8.0.1
• 8.0.2
• 8.0.3
• 8.0.4
• 8.0.5
• 8.0.6
• 8.0.7
• 8.0.8
• 8.0.9
• 8.0.10
• 8.0.11
• 8.0.12
• 8.0.13
• 8.0.14
• 8.0.15

License

• open-source

Website

• Vendor: https://www.oracle.com

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion