CVE-2021-2440: 
MySQL vulnerability analysis and mitigation

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML) affecting versions 8.0.25 and prior. This vulnerability was disclosed as part of Oracle's July 2021 Critical Patch Update (Oracle CPU). The vulnerability is tracked as CVE-2021-2440 and is easily exploitable by a high-privileged attacker with network access via multiple protocols (NVD).

The vulnerability has been assigned a CVSS v3.1 Base Score of 4.9 (Medium) with the following vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H. The scoring indicates that the vulnerability requires network access, has low attack complexity, requires high privileges, needs no user interaction, has unchanged scope, and can only impact availability with no effect on confidentiality or integrity (NVD, NetApp Advisory).

Successful exploitation of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. The impact is limited to availability with no compromise of data confidentiality or integrity (NVD).

The vulnerability is considered easily exploitable but requires a high-privileged attacker with network access. The attack can be conducted via multiple protocols. No known exploits specifically targeting this vulnerability have been reported in the wild (NVD).

Oracle has released patches to address this vulnerability in MySQL version 8.0.26. Users are strongly recommended to update to this version or later. Various vendors have also released patches for their products that incorporate MySQL, including NetApp and Ubuntu. Ubuntu users can update to mysql-server-8.0 version 8.0.26-0ubuntu0.20.04.2 for Ubuntu 20.04 and version 8.0.26-0ubuntu0.21.04.3 for Ubuntu 21.04 (Ubuntu Notice, NetApp Advisory).