CVE-2021-35628 : Security Advisory and Response

A vulnerability has been discovered in the MySQL Server product of Oracle MySQL, specifically within the Server Optimizer component. This vulnerability affects versions 8.0.26 and prior, potentially allowing a high privileged attacker to compromise the MySQL Server. Read on to understand the impact and how to mitigate this CVE.

Understanding CVE-2021-35628

This section will delve into the specifics of CVE-2021-35628, detailing the vulnerability, its impact, and how it can be exploited.

What is CVE-2021-35628?

The vulnerability in this CVE affects Oracle's MySQL Server product, particularly the Server Optimizer component. Attackers with network access can exploit this vulnerability in versions 8.0.26 and earlier, potentially leading to repeated crashes or Denial of Service (DoS) attacks on the MySQL Server.

The Impact of CVE-2021-35628

Successful exploitation of CVE-2021-35628 can result in a high privileged attacker causing a complete DoS of the MySQL Server. The CVSS 3.1 Base Score for this vulnerability is 4.9, with a focus on availability impacts.

Technical Details of CVE-2021-35628

In this section, we will explore the technical aspects of CVE-2021-35628, including vulnerability description, affected systems and versions, and the exploitation mechanism.

Vulnerability Description

The vulnerability allows attackers with high privileges and network access to compromise MySQL Server, potentially leading to repeated crashes or DoS attacks.

Affected Systems and Versions

CVE-2021-35628 affects versions 8.0.26 and prior of the MySQL Server product by Oracle Corporation.

Exploitation Mechanism

Attackers can exploit this vulnerability through multiple protocols with network access, resulting in unauthorized interruptions and crashes of MySQL Server.

Mitigation and Prevention

To protect systems from CVE-2021-35628, immediate actions can be taken along with long-term security practices and regular patching.

Immediate Steps to Take

Immediately update MySQL Server to versions that have patched this vulnerability. Monitor network activity for any suspicious behavior.

Long-Term Security Practices

Regularly update and patch software to ensure that known vulnerabilities are addressed promptly. Implement strong network security measures to prevent unauthorized access.

Patching and Updates

Stay informed about security advisories related to MySQL Server from Oracle Corporation. Apply patches and updates promptly to mitigate any known vulnerabilities.