CVE-2022-21286: 
MySQL vulnerability analysis and mitigation

The vulnerability (CVE-2022-21286) affects the MySQL Cluster product of Oracle MySQL (component: Cluster: General). The affected versions include MySQL Cluster 7.4.34 and prior, 7.5.24 and prior, 7.6.20 and prior, and 8.0.27 and prior. This vulnerability was disclosed in January 2022 as part of Oracle's Critical Patch Update (Oracle CPU).

This is a difficult to exploit vulnerability that requires a high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes. The vulnerability has a CVSS 3.1 Base Score of 6.3 (Medium) with the following vector: CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H. Successful exploitation requires human interaction from a person other than the attacker (Oracle CPU, ZDI Advisory).

If successfully exploited, this vulnerability can result in complete takeover of MySQL Cluster, potentially compromising the confidentiality, integrity, and availability of the system. The high CVSS impact scores (C:H/I:H/A:H) indicate that a successful attack could lead to a complete compromise of the system's security (Oracle CPU).

Oracle has released security patches to address this vulnerability as part of its January 2022 Critical Patch Update. Users are strongly recommended to update to the patched versions of MySQL Cluster. The patches are available for versions that are covered under Premier Support or Extended Support phases of the Lifetime Support Policy (Oracle CPU).