CVE-2024-21102: 
MySQL vulnerability analysis and mitigation

CVE-2024-21102 is a vulnerability in Oracle MySQL Server (component: Server: Thread Pooling) affecting versions 8.0.36 and prior, and 8.3.0 and prior. This vulnerability was disclosed in April 2024 as part of Oracle's Critical Patch Update (Oracle Advisory).

The vulnerability is characterized as easily exploitable, requiring a high-privileged attacker with network access via multiple protocols to compromise MySQL Server. It has been assigned a CVSS 3.1 Base Score of 4.9 (Medium severity) with the following vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H (Oracle Advisory, NVD).

Successful exploitation of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash, leading to a complete denial of service (DOS) of MySQL Server (NetApp Advisory).

The vulnerability requires network access and high privileges for exploitation. While it is considered easily exploitable once these conditions are met, the high privilege requirement somewhat mitigates the risk (Oracle Advisory).

Oracle has released patches to address this vulnerability in the April 2024 Critical Patch Update. Users should upgrade to MySQL Server versions after 8.0.36 or 8.3.0. Various vendors have also released patches for their affected products, including NetApp which has provided fixes for Active IQ Unified Manager, OnCommand Insight, OnCommand Workflow Automation, and SnapCenter (NetApp Advisory).