CVE-2024-21137: 
MySQL vulnerability analysis and mitigation

A vulnerability has been identified in the MySQL Server product of Oracle MySQL, specifically affecting the Server: Optimizer component. The vulnerability, tracked as CVE-2024-21137, affects MySQL versions 8.0.35 and prior, as well as 8.2.0 and prior. This security flaw was disclosed on July 16, 2024, and has been assigned a CVSS 3.1 Base Score of 4.9, indicating a medium severity level (Oracle Advisory).

The vulnerability is characterized as easily exploitable and requires a high-privileged attacker with network access via multiple protocols to compromise MySQL Server. The CVSS vector for this vulnerability is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H, which indicates network-based attack vector, low attack complexity, high privileges required, no user interaction needed, unchanged scope, and high impact on availability (NVD).

Successful exploitation of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash, leading to a complete denial of service (DoS) of MySQL Server. The impact is primarily focused on availability, with no direct impact on confidentiality or integrity of the system (Oracle Advisory).

The vulnerability is considered easily exploitable by attackers who have high privileges and network access. Multiple protocols can be used to execute the attack, though specific exploit details have not been publicly disclosed (Snyk).

The primary mitigation is to upgrade affected MySQL Server installations to patched versions. Various vendors have released updates to address this vulnerability: Ubuntu has released version 8.0.36-0ubuntu0.20.04.1, Red Hat has released version 8.0.36, and NetApp has provided patches for affected products including Active IQ Unified Manager (NetApp Advisory, Ubuntu).