CVE-2024-21050: 
MySQL vulnerability analysis and mitigation

A vulnerability has been identified in the MySQL Server product of Oracle MySQL (component: Server: DML), tracked as CVE-2024-21050. The vulnerability affects MySQL Server versions 8.0.34 and prior. This security flaw was disclosed in April 2024 as part of Oracle's Critical Patch Update (Oracle CPU).

The vulnerability has been assigned a CVSS 3.1 Base Score of 4.9 (Medium severity) with the following vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H. The vulnerability is easily exploitable and requires a high-privileged attacker with network access via multiple protocols to compromise MySQL Server (NVD).

Successful exploitation of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. The vulnerability only affects availability, with no impact on confidentiality or integrity (Oracle CPU).

The vulnerability is considered easily exploitable but requires high privileges and network access. The attack can be conducted through multiple protocols, though specific exploit details have not been publicly disclosed (NVD).

Oracle has released patches to address this vulnerability in MySQL version 8.0.35. Various vendors have also released fixes for their affected products. For example, NetApp has provided patches for affected products including Active IQ Unified Manager, OnCommand Insight, and OnCommand Workflow Automation (NetApp Advisory).