Linux · Security advisory · February 21, 2024

ELSA-2024-0894: Security update for 11 packages

ELSA-2024-0894, released February 21, 2024, fixes 75 CVEs across 11 products. None of them is reported as exploited. Patch Radar priority: High.

High

CVEs closed

None rated Critical

Exploited

None reported

Exploitation more likely

Vendor assessment

Highest EPSS

0.0213

82nd percentile

Priority of the 75 CVEs

Patch now 0
                                Urgent 0
                                High 75
                                Routine 0

Fixed package versions

Product	Release	Fixed in
mecab	ol 8	0:0.996-2.module+el8.9.0+90153+70413b10
mecab-devel	ol 8	0:0.996-2.module+el8.9.0+90153+70413b10
mecab-ipadic	ol 8	0:2.7.0.20070801-16.0.1.module+el8.9.0+90153+70413b10
mecab-ipadic-EUCJP	ol 8	0:2.7.0.20070801-16.0.1.module+el8.9.0+90153+70413b10
mysql	ol 8	0:8.0.36-1.module+el8.9.0+90153+70413b10
mysql-common	ol 8	0:8.0.36-1.module+el8.9.0+90153+70413b10
mysql-devel	ol 8	0:8.0.36-1.module+el8.9.0+90153+70413b10
mysql-errmsg	ol 8	0:8.0.36-1.module+el8.9.0+90153+70413b10
mysql-libs	ol 8	0:8.0.36-1.module+el8.9.0+90153+70413b10
mysql-server	ol 8	0:8.0.36-1.module+el8.9.0+90153+70413b10
mysql-test	ol 8	0:8.0.36-1.module+el8.9.0+90153+70413b10

CVEs this fix closes

Priority	CVE	Title	CVSS	EPSS	Exploitation
High	CVE-2023-22084	libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:InnoDB)	7.5	0.0213	None reported
High	CVE-2023-22056	libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: Optimizer)	7.5	0.0182	None reported
High	CVE-2023-22058	libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: DDL)	7.5	0.0170	None reported
High	CVE-2022-4899	mecab: MySQL is a multi-user, multi-threaded SQL database server	7.5	0.0159	None reported
High	CVE-2024-20965	libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: Optimizer)	7.5	0.0154	None reported
High	CVE-2023-21946	libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: Optimizer)	7.5	0.0150	None reported
High	CVE-2023-21920	mysql-testsuite: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: Optimizer)	7.5	0.0147	None reported
High	CVE-2023-21919	libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: DDL)	7.5	0.0146	None reported
High	CVE-2023-21953	libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: Partition)	7.5	0.0146	None reported
High	CVE-2023-21933	libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: DDL)	7.5	0.0140	None reported
High	CVE-2023-21945	libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: Optimizer)	7.5	0.0140	None reported
High	CVE-2023-21935	libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: Optimizer)	7.5	0.0139	None reported
High	CVE-2023-21955	mysql-testsuite: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: Partition)	7.5	0.0139	None reported
High	CVE-2023-21962	libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: Components Services)	7.5	0.0139	None reported
High	CVE-2023-22054	mysql-testsuite: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: Optimizer)	7.5	0.0138	None reported
High	CVE-2023-22057	libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: Replication)	7.5	0.0138	None reported
High	CVE-2023-21911	libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:InnoDB)	7.5	0.0137	None reported
High	CVE-2023-21947	libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: Components Services)	7.5	0.0137	None reported
High	CVE-2023-22053	mysql-testsuite: Vulnerability in the MySQL Server product of Oracle MySQL (component:Client programs)	7.5	0.0133	None reported
High	CVE-2023-22008	libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:InnoDB)	7.5	0.0132	None reported
High	CVE-2023-22046	mysql-client-core-8.0: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: Optimizer)	7.5	0.0132	None reported
High	CVE-2023-21940	mysql-server-core-8.0: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: Components Services)	7.5	0.0129	None reported
High	CVE-2023-22005	libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: Replication)	7.5	0.0129	None reported
High	CVE-2023-21929	libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: DDL)	7.5	0.0128	None reported
High	CVE-2023-22033	mysql-testsuite-8.0: Vulnerability in the MySQL Server product of Oracle MySQL (component:InnoDB)	7.5	0.0123	None reported

Also fixes CVE-2023-22084

RLSA-2024:0894
mecab, mecab-ipadic, mysql on rocky 8
RHSA-2024:1141
mysql, mysql-common, mysql-devel and 4 more on RHEL 9
ALSA-2024:0894
mecab, mecab-devel, mecab-ipadic and 8 more on almalinux 8
RHSA-2024:0894
mecab, mecab-devel, mecab-ipadic and 8 more on RHEL 8
ALSA-2024:1141
mysql, mysql-common, mysql-devel and 4 more on almalinux 9
ELSA-2024-1141
mysql, mysql-common, mysql-devel and 4 more on ol 9
libmysqlclient21 8.0.35-0ubuntu1
libmysqlclient21 on Ubuntu 24.10 (oracular)
mysql-client 8.0.35-0ubuntu1
mysql-client on Ubuntu 24.10 (oracular)

Vendor advisory

https://linux.oracle.com/errata/ELSA-2024-0894.html

For tools and AI agents

This page as data: JSON · Markdown

Which servers are still behind?

Patchblox compares the installed package on every Linux machine against the fixed version for its release, including machines reported through Azure Update Manager.

Get a demo