CVE-2022-21312: 
MySQL vulnerability analysis and mitigation

CVE-2022-21312 is a vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). The vulnerability affects versions 7.4.34 and prior, 7.5.24 and prior, 7.6.20 and prior, and 8.0.27 and prior. This is a difficult-to-exploit vulnerability that requires a high-privileged attacker with access to the physical communication segment attached to the hardware where MySQL Cluster executes, as well as human interaction from a person other than the attacker (Oracle CPU).

The vulnerability has a CVSS 3.1 Base Score of 2.9 (Low) with the vector string CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:L. The attack requires adjacent network access, has high attack complexity, requires high privileges, and needs user interaction. The vulnerability can result in low impact to both confidentiality and availability, with no impact on integrity (NetApp Advisory).

Successful exploitation of this vulnerability can result in unauthorized read access to a subset of MySQL Cluster accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Cluster (ZDI Advisory).

Oracle has issued updates to correct this vulnerability in their January 2022 Critical Patch Update. Users should upgrade to versions newer than 7.4.34, 7.5.24, 7.6.20, or 8.0.27 depending on their current version track (Oracle CPU).