# CVE-2021-2154: galera: MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL

CVE-2021-2154 is fixed in 26 products on 1 platform, first by libmysqlclient20 5.7.34-0ubuntu0.18.04.1, released April 22, 2021. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2021-2154
- Priority: High
- CVSS: 7.5 (Moderate)
- EPSS: 0.0260
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Apr 22, 2021

## Description

MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL.   The following packages have been upgraded to a later upstream version: mariadb (10.5.13), galera (26.4.9). (BZ#2050546)  Security Fix(es):  * mysql: Server: DML unspecified vulnerability (CPU Apr 2021) (CVE-2021-2154)  * mysql: Server: DML unspecified vulnerability (CPU Apr 2021) (CVE-2021-2166)  * mysql: InnoDB unspecified vulnerability (CPU Jul 2021) (CVE-2021-2372)  * mysql: InnoDB unspecified vulnerability (CPU Jul 2021) (CVE-2021-2389)  * mysql: InnoDB unspecified vulnerability (CPU Oct 2021) (CVE-2021-35604)  * mariadb: Integer overflow in sql_lex.cc integer leading to crash (CVE-2021-46667)  * mariadb: Crash in get_sort_by_table() in subquery with ORDER BY having outer ref (CVE-2021-46657)  * mariadb: save_window_function_values triggers an abort during IN subquery (CVE-2021-46658)  * mariadb: Crash in set_var.cc via certain UPDATE queries with nested subqueries (CVE-2021-46662)  * mariadb: Crash caused by mishandling of a pushdown from a HAVING clause to a WHERE clause (CVE-2021-46666)  * mariadb: No password masking in audit log when using ALTER USER <user> IDENTIFIED BY <password> command (BZ#1981332)  For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.  Bug Fix(es):  * mariadb-10.5-module: /etc/security/user_map.conf getting overwritten with mariadb-server upgrade (BZ#2050515)  * mariadb-server:10.5 in centos8 stream is not shipping wsrep_sst_rsync_tunnel (BZ#2050524)  * Galera doesn't work without 'procps-ng' package MariaDB-10.5 (BZ#2050542)

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | Judy RHEL 8 | 0:1.0.5-18.module+el8.4.0+9031+9abc7af9 | [RHSA-2022:1557](https://patchblox.com/security/data/fix/linux/rhsa-2022-1557.md) | Apr 26, 2022 |
| Linux | Judy almalinux 8 | 1.0.5-18.module_el8.6.0+2867+72759d2f | [ALSA-2022:1557](https://patchblox.com/security/data/fix/linux/alsa-2022-1557.md) | Apr 26, 2022 |
| Linux | Judy ol 8 | 0:1.0.5-18.module+el8.4.0+20040+caf70fad | [ELSA-2022-1557](https://patchblox.com/security/data/fix/linux/elsa-2022-1557.md) | May 3, 2022 |
| Linux | Judy rocky 8 | 0:1.0.5-18.module+el8.4.0+427+adf35707 | [RLSA-2022:1557](https://patchblox.com/security/data/fix/linux/rlsa-2022-1557.md) | Apr 26, 2022 |
| Linux | galera RHEL 8 | 0:26.4.9-4.module+el8.5.0+14125+d11efe18 | [RHSA-2022:1557](https://patchblox.com/security/data/fix/linux/rhsa-2022-1557.md) | Apr 26, 2022 |
| Linux | galera almalinux 8 | 26.4.9-4.module_el8.6.0+2761+593e5e59 | [ALSA-2022:1557](https://patchblox.com/security/data/fix/linux/alsa-2022-1557.md) | Apr 26, 2022 |
| Linux | galera ol 8 | 0:26.4.9-4.module+el8.5.0+20630+d7805586 | [ELSA-2022-1557](https://patchblox.com/security/data/fix/linux/elsa-2022-1557.md) | May 3, 2022 |
| Linux | galera rocky 8 | 0:26.4.9-4.module+el8.5.0+773+f75e97f7 | [RLSA-2022:1557](https://patchblox.com/security/data/fix/linux/rlsa-2022-1557.md) | Apr 26, 2022 |
| Linux | libmysqlclient20 Ubuntu 18.04.6 LTS (bionic) | 5.7.34-0ubuntu0.18.04.1 | [libmysqlclient20 5.7.34-0ubuntu0.18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libmysqlclient20-5.7.34-0ubuntu0.18.04.1.md) | Apr 22, 2021 |
| Linux | mariadb RHEL 8 | 3:10.5.13-1.module+el8.5.0+14125+d11efe18 | [RHSA-2022:1557](https://patchblox.com/security/data/fix/linux/rhsa-2022-1557.md) | Apr 26, 2022 |
| Linux | mariadb almalinux 8 | 3:10.5.13-1.module_el8.5.0+2637+d11efe18 | [ALSA-2022:1557](https://patchblox.com/security/data/fix/linux/alsa-2022-1557.md) | Apr 26, 2022 |
| Linux | mariadb ol 8 | 3:10.5.13-1.module+el8.5.0+20630+d7805586 | [ELSA-2022-1557](https://patchblox.com/security/data/fix/linux/elsa-2022-1557.md) | May 3, 2022 |
| Linux | mariadb rocky 8 | 3:10.5.13-1.module+el8.5.0+773+f75e97f7 | [RLSA-2022:1557](https://patchblox.com/security/data/fix/linux/rlsa-2022-1557.md) | Apr 26, 2022 |
| Linux | mariadb-backup RHEL 8 | 3:10.5.13-1.module+el8.5.0+14125+d11efe18 | [RHSA-2022:1557](https://patchblox.com/security/data/fix/linux/rhsa-2022-1557.md) | Apr 26, 2022 |
| Linux | mariadb-backup almalinux 8 | 3:10.5.13-1.module_el8.6.0+2761+593e5e59 | [ALSA-2022:1557](https://patchblox.com/security/data/fix/linux/alsa-2022-1557.md) | Apr 26, 2022 |
| Linux | mariadb-backup ol 8 | 3:10.5.13-1.module+el8.5.0+20630+d7805586 | [ELSA-2022-1557](https://patchblox.com/security/data/fix/linux/elsa-2022-1557.md) | May 3, 2022 |
| Linux | mariadb-common RHEL 8 | 3:10.5.13-1.module+el8.5.0+14125+d11efe18 | [RHSA-2022:1557](https://patchblox.com/security/data/fix/linux/rhsa-2022-1557.md) | Apr 26, 2022 |
| Linux | mariadb-common almalinux 8 | 3:10.5.13-1.module_el8.6.0+2761+593e5e59 | [ALSA-2022:1557](https://patchblox.com/security/data/fix/linux/alsa-2022-1557.md) | Apr 26, 2022 |
| Linux | mariadb-common ol 8 | 3:10.5.13-1.module+el8.5.0+20630+d7805586 | [ELSA-2022-1557](https://patchblox.com/security/data/fix/linux/elsa-2022-1557.md) | May 3, 2022 |
| Linux | mariadb-devel RHEL 8 | 3:10.5.13-1.module+el8.5.0+14125+d11efe18 | [RHSA-2022:1557](https://patchblox.com/security/data/fix/linux/rhsa-2022-1557.md) | Apr 26, 2022 |
| Linux | mariadb-devel almalinux 8 | 3:10.5.13-1.module_el8.5.0+2637+d11efe18 | [ALSA-2022:1557](https://patchblox.com/security/data/fix/linux/alsa-2022-1557.md) | Apr 26, 2022 |
| Linux | mariadb-devel ol 8 | 3:10.5.13-1.module+el8.5.0+20630+d7805586 | [ELSA-2022-1557](https://patchblox.com/security/data/fix/linux/elsa-2022-1557.md) | May 3, 2022 |
| Linux | mariadb-embedded RHEL 8 | 3:10.5.13-1.module+el8.5.0+14125+d11efe18 | [RHSA-2022:1557](https://patchblox.com/security/data/fix/linux/rhsa-2022-1557.md) | Apr 26, 2022 |
| Linux | mariadb-embedded almalinux 8 | 3:10.5.13-1.module_el8.6.0+2761+593e5e59 | [ALSA-2022:1557](https://patchblox.com/security/data/fix/linux/alsa-2022-1557.md) | Apr 26, 2022 |
| Linux | mariadb-embedded ol 8 | 3:10.5.13-1.module+el8.5.0+20630+d7805586 | [ELSA-2022-1557](https://patchblox.com/security/data/fix/linux/elsa-2022-1557.md) | May 3, 2022 |
| Linux | mariadb-embedded-devel RHEL 8 | 3:10.5.13-1.module+el8.5.0+14125+d11efe18 | [RHSA-2022:1557](https://patchblox.com/security/data/fix/linux/rhsa-2022-1557.md) | Apr 26, 2022 |
| Linux | mariadb-embedded-devel almalinux 8 | 3:10.5.13-1.module_el8.6.0+2761+593e5e59 | [ALSA-2022:1557](https://patchblox.com/security/data/fix/linux/alsa-2022-1557.md) | Apr 26, 2022 |
| Linux | mariadb-embedded-devel ol 8 | 3:10.5.13-1.module+el8.5.0+20630+d7805586 | [ELSA-2022-1557](https://patchblox.com/security/data/fix/linux/elsa-2022-1557.md) | May 3, 2022 |
| Linux | mariadb-errmsg RHEL 8 | 3:10.5.13-1.module+el8.5.0+14125+d11efe18 | [RHSA-2022:1557](https://patchblox.com/security/data/fix/linux/rhsa-2022-1557.md) | Apr 26, 2022 |
| Linux | mariadb-errmsg almalinux 8 | 3:10.5.13-1.module_el8.6.0+2761+593e5e59 | [ALSA-2022:1557](https://patchblox.com/security/data/fix/linux/alsa-2022-1557.md) | Apr 26, 2022 |
| Linux | mariadb-errmsg ol 8 | 3:10.5.13-1.module+el8.5.0+20630+d7805586 | [ELSA-2022-1557](https://patchblox.com/security/data/fix/linux/elsa-2022-1557.md) | May 3, 2022 |
| Linux | mariadb-gssapi-server RHEL 8 | 3:10.5.13-1.module+el8.5.0+14125+d11efe18 | [RHSA-2022:1557](https://patchblox.com/security/data/fix/linux/rhsa-2022-1557.md) | Apr 26, 2022 |
| Linux | mariadb-gssapi-server almalinux 8 | 3:10.5.13-1.module_el8.6.0+2761+593e5e59 | [ALSA-2022:1557](https://patchblox.com/security/data/fix/linux/alsa-2022-1557.md) | Apr 26, 2022 |
| Linux | mariadb-gssapi-server ol 8 | 3:10.5.13-1.module+el8.5.0+20630+d7805586 | [ELSA-2022-1557](https://patchblox.com/security/data/fix/linux/elsa-2022-1557.md) | May 3, 2022 |
| Linux | mariadb-oqgraph-engine RHEL 8 | 3:10.5.13-1.module+el8.5.0+14125+d11efe18 | [RHSA-2022:1557](https://patchblox.com/security/data/fix/linux/rhsa-2022-1557.md) | Apr 26, 2022 |
| Linux | mariadb-oqgraph-engine almalinux 8 | 3:10.5.13-1.module_el8.6.0+2761+593e5e59 | [ALSA-2022:1557](https://patchblox.com/security/data/fix/linux/alsa-2022-1557.md) | Apr 26, 2022 |
| Linux | mariadb-oqgraph-engine ol 8 | 3:10.5.13-1.module+el8.5.0+20630+d7805586 | [ELSA-2022-1557](https://patchblox.com/security/data/fix/linux/elsa-2022-1557.md) | May 3, 2022 |
| Linux | mariadb-pam RHEL 8 | 3:10.5.13-1.module+el8.5.0+14125+d11efe18 | [RHSA-2022:1557](https://patchblox.com/security/data/fix/linux/rhsa-2022-1557.md) | Apr 26, 2022 |
| Linux | mariadb-pam almalinux 8 | 3:10.5.13-1.module_el8.6.0+2761+593e5e59 | [ALSA-2022:1557](https://patchblox.com/security/data/fix/linux/alsa-2022-1557.md) | Apr 26, 2022 |
| Linux | mariadb-pam ol 8 | 3:10.5.13-1.module+el8.5.0+20630+d7805586 | [ELSA-2022-1557](https://patchblox.com/security/data/fix/linux/elsa-2022-1557.md) | May 3, 2022 |
| Linux | mariadb-server RHEL 8 | 3:10.5.13-1.module+el8.5.0+14125+d11efe18 | [RHSA-2022:1557](https://patchblox.com/security/data/fix/linux/rhsa-2022-1557.md) | Apr 26, 2022 |
| Linux | mariadb-server almalinux 8 | 3:10.5.13-1.module_el8.5.0+2637+d11efe18 | [ALSA-2022:1557](https://patchblox.com/security/data/fix/linux/alsa-2022-1557.md) | Apr 26, 2022 |
| Linux | mariadb-server ol 8 | 3:10.5.13-1.module+el8.5.0+20630+d7805586 | [ELSA-2022-1557](https://patchblox.com/security/data/fix/linux/elsa-2022-1557.md) | May 3, 2022 |
| Linux | mariadb-server-galera RHEL 8 | 3:10.5.13-1.module+el8.5.0+14125+d11efe18 | [RHSA-2022:1557](https://patchblox.com/security/data/fix/linux/rhsa-2022-1557.md) | Apr 26, 2022 |
| Linux | mariadb-server-galera almalinux 8 | 3:10.5.13-1.module_el8.6.0+2761+593e5e59 | [ALSA-2022:1557](https://patchblox.com/security/data/fix/linux/alsa-2022-1557.md) | Apr 26, 2022 |
| Linux | mariadb-server-galera ol 8 | 3:10.5.13-1.module+el8.5.0+20630+d7805586 | [ELSA-2022-1557](https://patchblox.com/security/data/fix/linux/elsa-2022-1557.md) | May 3, 2022 |
| Linux | mariadb-server-utils RHEL 8 | 3:10.5.13-1.module+el8.5.0+14125+d11efe18 | [RHSA-2022:1557](https://patchblox.com/security/data/fix/linux/rhsa-2022-1557.md) | Apr 26, 2022 |
| Linux | mariadb-server-utils almalinux 8 | 3:10.5.13-1.module_el8.6.0+2761+593e5e59 | [ALSA-2022:1557](https://patchblox.com/security/data/fix/linux/alsa-2022-1557.md) | Apr 26, 2022 |
| Linux | mariadb-server-utils ol 8 | 3:10.5.13-1.module+el8.5.0+20630+d7805586 | [ELSA-2022-1557](https://patchblox.com/security/data/fix/linux/elsa-2022-1557.md) | May 3, 2022 |
| Linux | mariadb-test RHEL 8 | 3:10.5.13-1.module+el8.5.0+14125+d11efe18 | [RHSA-2022:1557](https://patchblox.com/security/data/fix/linux/rhsa-2022-1557.md) | Apr 26, 2022 |
| Linux | mariadb-test almalinux 8 | 3:10.5.13-1.module_el8.6.0+2761+593e5e59 | [ALSA-2022:1557](https://patchblox.com/security/data/fix/linux/alsa-2022-1557.md) | Apr 26, 2022 |
| Linux | mariadb-test ol 8 | 3:10.5.13-1.module+el8.5.0+20630+d7805586 | [ELSA-2022-1557](https://patchblox.com/security/data/fix/linux/elsa-2022-1557.md) | May 3, 2022 |
| Linux | mysql-client Ubuntu 18.04.6 LTS (bionic) | 5.7.34-0ubuntu0.18.04.1 | [mysql-client 5.7.34-0ubuntu0.18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-mysql-client-5.7.34-0ubuntu0.18.04.1.md) | Apr 22, 2021 |
| Linux | mysql-client-5.7 Ubuntu 18.04.6 LTS (bionic) | 5.7.34-0ubuntu0.18.04.1 | [mysql-client-5.7 5.7.34-0ubuntu0.18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-mysql-client-5.7-5.7.34-0ubuntu0.18.04.1.md) | Apr 22, 2021 |
| Linux | mysql-client-core-5.7 Ubuntu 18.04.6 LTS (bionic) | 5.7.34-0ubuntu0.18.04.1 | [mysql-client-core-5.7 5.7.34-0ubuntu0.18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-mysql-client-core-5.7-5.7.34-0ubuntu0.18.04.1.md) | Apr 22, 2021 |
| Linux | mysql-server Ubuntu 18.04.6 LTS (bionic) | 5.7.34-0ubuntu0.18.04.1 | [mysql-server 5.7.34-0ubuntu0.18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-mysql-server-5.7.34-0ubuntu0.18.04.1.md) | Apr 22, 2021 |
| Linux | mysql-server-5.7 Ubuntu 18.04.6 LTS (bionic) | 5.7.34-0ubuntu0.18.04.1 | [mysql-server-5.7 5.7.34-0ubuntu0.18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-mysql-server-5.7-5.7.34-0ubuntu0.18.04.1.md) | Apr 22, 2021 |
| Linux | mysql-server-core-5.7 Ubuntu 18.04.6 LTS (bionic) | 5.7.34-0ubuntu0.18.04.1 | [mysql-server-core-5.7 5.7.34-0ubuntu0.18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-mysql-server-core-5.7-5.7.34-0ubuntu0.18.04.1.md) | Apr 22, 2021 |
| Linux | mysql-source-5.7 Ubuntu 18.04.6 LTS (bionic) | 5.7.34-0ubuntu0.18.04.1 | [mysql-source-5.7 5.7.34-0ubuntu0.18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-mysql-source-5.7-5.7.34-0ubuntu0.18.04.1.md) | Apr 22, 2021 |
| Linux | mysql-testsuite Ubuntu 18.04.6 LTS (bionic) | 5.7.34-0ubuntu0.18.04.1 | [mysql-testsuite 5.7.34-0ubuntu0.18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-mysql-testsuite-5.7.34-0ubuntu0.18.04.1.md) | Apr 22, 2021 |
| Linux | mysql-testsuite-5.7 Ubuntu 18.04.6 LTS (bionic) | 5.7.34-0ubuntu0.18.04.1 | [mysql-testsuite-5.7 5.7.34-0ubuntu0.18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-mysql-testsuite-5.7-5.7.34-0ubuntu0.18.04.1.md) | Apr 22, 2021 |

---

Data as of 2026-11-08T00:53:09Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.