CVE-2024-21096: 
MySQL vulnerability analysis and mitigation

CVE-2024-21096 is a vulnerability in MySQL Server's mysqldump component affecting versions 8.0.36 and prior, and 8.3.0 and prior. This vulnerability allows an unauthenticated attacker with logon access to the infrastructure where MySQL Server executes to compromise the server. The vulnerability was disclosed in Oracle's April 2024 Critical Patch Update (Oracle CPU).

The vulnerability has been assigned a CVSS 3.1 Base Score of 4.9 (Medium) with the following vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L. The attack requires local access (AV:L) with high complexity (AC:H), requires no privileges (PR:N), and needs no user interaction (UI:N). The scope is unchanged (S:U), with low impacts to confidentiality, integrity, and availability (NVD).

Successful exploitation of this vulnerability can result in unauthorized update, insert or delete access to some MySQL Server accessible data, unauthorized read access to a subset of MySQL Server accessible data, and unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server (NVD).

The vulnerability is described as difficult to exploit, requiring an attacker to have logon access to the infrastructure where MySQL Server executes. The attack complexity is rated as high, indicating significant technical expertise and specific conditions are required for successful exploitation (NVD).

Multiple vendors have released patches to address this vulnerability. MariaDB has fixed this in versions 11.2.4, 11.1.5, 11.0.6, 10.11.8, 10.6.18, and 10.5.25. The fix may cause compatibility issues with older MariaDB and MySQL clients, with workarounds detailed at MariaDB's website (Debian Security). Oracle has also released patches in their April 2024 Critical Patch Update (Oracle CPU).