CVE-2023-21940: 
MySQL vulnerability analysis and mitigation

CVE-2023-21940 is a vulnerability in the MySQL Server product of Oracle MySQL, specifically affecting the Server: Components Services component. The vulnerability affects MySQL Server versions 8.0.32 and prior. It was disclosed in April 2023 as part of Oracle's Critical Patch Update (Oracle CPU).

This is a difficult to exploit vulnerability that requires a high-privileged attacker with network access via multiple protocols to compromise MySQL Server. The vulnerability has been assigned a CVSS 3.1 Base Score of 4.4 (Medium) with the following vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H (NVD).

Successful exploitation of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash, leading to a complete denial of service (DoS) of MySQL Server. The vulnerability only affects availability, with no impact on confidentiality or integrity (Oracle CPU).

Oracle has released patches to address this vulnerability in MySQL version 8.0.33. Various distributions have also released fixed versions, including Ubuntu which has fixed the issue in MySQL 8.0.33-0ubuntu0.22.04.1 for version 22.04 LTS, and Fedora which has addressed it in community-mysql-8.0.34-2 for versions 37, 38, and 39 (Ubuntu Security, Fedora Updates).