Linux · Security advisory · March 6, 2024

ELSA-2024-1141: Security update for 7 packages

ELSA-2024-1141, released March 6, 2024, fixes 75 CVEs across 7 products. None of them is reported as exploited. Patch Radar priority: High.

High

CVEs closed

None rated Critical

Exploited

None reported

Exploitation more likely

Vendor assessment

Highest EPSS

0.0213

82nd percentile

Priority of the 75 CVEs

Patch now 0
                                Urgent 0
                                High 75
                                Routine 0

Fixed package versions

Product	Release	Fixed in
mysql	ol 9	0:8.0.36-1.el9_3
mysql-common	ol 9	0:8.0.36-1.el9_3
mysql-devel	ol 9	0:8.0.36-1.el9_3
mysql-errmsg	ol 9	0:8.0.36-1.el9_3
mysql-libs	ol 9	0:8.0.36-1.el9_3
mysql-server	ol 9	0:8.0.36-1.el9_3
mysql-test	ol 9	0:8.0.36-1.el9_3

CVEs this fix closes

Priority	CVE	Title	CVSS	EPSS	Exploitation
High	CVE-2023-22084	libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:InnoDB)	7.5	0.0213	None reported
High	CVE-2023-22056	libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: Optimizer)	7.5	0.0182	None reported
High	CVE-2023-22058	libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: DDL)	7.5	0.0170	None reported
High	CVE-2022-4899	mecab: MySQL is a multi-user, multi-threaded SQL database server	7.5	0.0159	None reported
High	CVE-2024-20965	libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: Optimizer)	7.5	0.0154	None reported
High	CVE-2023-21946	libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: Optimizer)	7.5	0.0150	None reported
High	CVE-2023-21920	mysql-testsuite: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: Optimizer)	7.5	0.0147	None reported
High	CVE-2023-21919	libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: DDL)	7.5	0.0146	None reported
High	CVE-2023-21953	libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: Partition)	7.5	0.0146	None reported
High	CVE-2023-21933	libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: DDL)	7.5	0.0140	None reported
High	CVE-2023-21945	libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: Optimizer)	7.5	0.0140	None reported
High	CVE-2023-21935	libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: Optimizer)	7.5	0.0139	None reported
High	CVE-2023-21955	mysql-testsuite: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: Partition)	7.5	0.0139	None reported
High	CVE-2023-21962	libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: Components Services)	7.5	0.0139	None reported
High	CVE-2023-22054	mysql-testsuite: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: Optimizer)	7.5	0.0138	None reported
High	CVE-2023-22057	libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: Replication)	7.5	0.0138	None reported
High	CVE-2023-21911	libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:InnoDB)	7.5	0.0137	None reported
High	CVE-2023-21947	libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: Components Services)	7.5	0.0137	None reported
High	CVE-2023-22053	mysql-testsuite: Vulnerability in the MySQL Server product of Oracle MySQL (component:Client programs)	7.5	0.0133	None reported
High	CVE-2023-22008	libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:InnoDB)	7.5	0.0132	None reported
High	CVE-2023-22046	mysql-client-core-8.0: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: Optimizer)	7.5	0.0132	None reported
High	CVE-2023-21940	mysql-server-core-8.0: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: Components Services)	7.5	0.0129	None reported
High	CVE-2023-22005	libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: Replication)	7.5	0.0129	None reported
High	CVE-2023-21929	libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: DDL)	7.5	0.0128	None reported
High	CVE-2023-22033	mysql-testsuite-8.0: Vulnerability in the MySQL Server product of Oracle MySQL (component:InnoDB)	7.5	0.0123	None reported

Also fixes CVE-2023-22084

RLSA-2024:0894
mecab, mecab-ipadic, mysql on rocky 8
RHSA-2024:1141
mysql, mysql-common, mysql-devel and 4 more on RHEL 9
ALSA-2024:0894
mecab, mecab-devel, mecab-ipadic and 8 more on almalinux 8
RHSA-2024:0894
mecab, mecab-devel, mecab-ipadic and 8 more on RHEL 8
ALSA-2024:1141
mysql, mysql-common, mysql-devel and 4 more on almalinux 9
ELSA-2024-0894
mecab, mecab-devel, mecab-ipadic and 8 more on ol 8
libmysqlclient21 8.0.35-0ubuntu1
libmysqlclient21 on Ubuntu 24.10 (oracular)
mysql-client 8.0.35-0ubuntu1
mysql-client on Ubuntu 24.10 (oracular)

Vendor advisory

https://linux.oracle.com/errata/ELSA-2024-1141.html

For tools and AI agents

This page as data: JSON · Markdown

Which servers are still behind?

Patchblox compares the installed package on every Linux machine against the fixed version for its release, including machines reported through Azure Update Manager.

Get a demo