CVE-2022-21313: 
MySQL vulnerability analysis and mitigation

CVE-2022-21313 is a vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). The vulnerability affects versions 7.6.20 and prior, and 8.0.27 and prior. It was disclosed in January 2022 as part of Oracle's Critical Patch Update. This is classified as a difficult-to-exploit vulnerability that requires high privileges and human interaction (Oracle CPU).

The vulnerability has a CVSS 3.1 Base Score of 2.9 (LOW) with the vector string: CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:L. The specific flaw exists within the processing of Data Node jobs. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an array (ZDI Advisory).

Successful exploitation of this vulnerability can result in unauthorized read access to a subset of MySQL Cluster accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Cluster (Oracle CPU, ZDI Advisory).

Oracle has issued an update to correct this vulnerability. Users should upgrade to versions after 7.6.20 for the 7.6.x series or versions after 8.0.27 for the 8.0.x series (ZDI Advisory, Oracle CPU).