CVE-2021-27928: debian debian_linux Code Injection

CVSS: 9.0v2.0HighModified

AliasesALPINE-CVE-2021-27928RHSA-2021:1039RHSA-2021:1240+22 more

Published 19-03-2021Last modified 03-08-2024

Vulnerability summary

CVE-2021-27928 is a high (CVSS 9.0) Code Injection vulnerability in debian debian_linux. EPSS estimates a 38.44% chance of exploitation in the next 30 days, higher than 98.5% of scored vulnerabilities. 2 public exploits are recorded.

Overall risk

70/100

0100

High · default modelHow is this calculated?

CVSS score

9.0/10

010

High · v2.0 (NVD)

EPSS score

38.44%

0%100%

High · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits2reference, exploit-database

Advisory lineage

Upstream 0 · Downstream 10 · Related 12

OPENSUSE-SU-2021:2605-1 OPENSUSE-SU-2021:2616-1 OPENSUSE-SU-2021:2617-1 OPENSUSE-SU-2024:11648-1 SUSE-RU-2023:3956-1 SUSE-RU-2023:4991-1+6 more

Timeline

19-03-2021
PublishedVulnerability first disclosed.
03-08-2024
Last modifiedVulnerability information updated.

Description

A remote code execution issue was discovered in MariaDB 10.2 before 10.2.37, 10.3 before 10.3.28, 10.4 before 10.4.18, and 10.5 before 10.5.9; Percona Server through 2021-03-03; and the wsrep patch through 2021-03-03 for MySQL. An untrusted search path leads to eval injection, in which a database SUPER user can execute OS commands after modifying wsrep_provider and wsrep_notify_cmd. NOTE: this does not affect an Oracle product.

CVSS metrics

8 scores · 7 sources · 2 versions

v3.17.2v2.09.0

EPSS trend

Probability

38.44%

Chance of exploitation in the next 30 days

Percentile

99%

Versus all other CVEs

30-day change

0.00 pp

From 38.44% on 20-09-2026

20-09-202620-10-2026

EPSS score

38.44%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

2 found

referenceUnverified
Exploit Reference (packetstormsecurity.com)
Maturity: unknown
exploit-databaselocallinuxUnverified
MariaDB 10.2 - 'wsrep_provider' OS Command Execution
Maturity: poc

Weaknesses

CWE · root cause

CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Affected systems

Redhat56 products

asio< 0:1.10.8-7.module+el8+2765+cfa4f87b
asio-devel< 0:1.10.8-7.module+el8+2765+cfa4f87b
galera< 0:25.3.32-1.module+el8.2.0+10474+c7510d9c | < 0:25.3.32-1.module+el8.1.0+10475+47ea4373 | < 0:25.3.32-1.module+el8.3.0+10472+7adc332a
galera-debuginfo< 0:25.3.32-1.module+el8.2.0+10474+c7510d9c | < 0:25.3.32-1.module+el8.1.0+10475+47ea4373 | < 0:25.3.32-1.module+el8.3.0+10472+7adc332a
galera-debugsource< 0:25.3.32-1.module+el8.2.0+10474+c7510d9c | < 0:25.3.32-1.module+el8.1.0+10475+47ea4373 | < 0:25.3.32-1.module+el8.3.0+10472+7adc332a

Judy< 0:1.0.5-18.module+el8+2765+cfa4f87b
Judy-debuginfo< 0:1.0.5-18.module+el8+2765+cfa4f87b
Judy-debugsource< 0:1.0.5-18.module+el8+2765+cfa4f87b
Judy-devel< 0:1.0.5-18.module+el8+2765+cfa4f87b
mariadb< 3:10.1.20-3.el7ost | < 3:10.3.28-1.module+el8.2.0+10474+c7510d9c | < 3:10.3.28-1.module+el8.1.0+10475+47ea4373 | < 3:10.3.28-1.module+el8.3.0+10472+7adc332a
mariadb-backup< 3:10.3.28-1.module+el8.2.0+10474+c7510d9c | < 3:10.3.28-1.module+el8.1.0+10475+47ea4373 | < 3:10.3.28-1.module+el8.3.0+10472+7adc332a
mariadb-backup-debuginfo< 3:10.3.28-1.module+el8.2.0+10474+c7510d9c | < 3:10.3.28-1.module+el8.1.0+10475+47ea4373 | < 3:10.3.28-1.module+el8.3.0+10472+7adc332a
mariadb-common< 3:10.1.20-3.el7ost | < 3:10.3.28-1.module+el8.2.0+10474+c7510d9c | < 3:10.3.28-1.module+el8.1.0+10475+47ea4373 | < 3:10.3.28-1.module+el8.3.0+10472+7adc332a
mariadb-config< 3:10.1.20-3.el7ost
mariadb-connect-engine< 3:10.1.20-3.el7ost
mariadb-debuginfo< 3:10.1.20-3.el7ost | < 3:10.3.28-1.module+el8.2.0+10474+c7510d9c | < 3:10.3.28-1.module+el8.1.0+10475+47ea4373 | < 3:10.3.28-1.module+el8.3.0+10472+7adc332a
mariadb-debugsource< 3:10.3.28-1.module+el8.2.0+10474+c7510d9c | < 3:10.3.28-1.module+el8.1.0+10475+47ea4373 | < 3:10.3.28-1.module+el8.3.0+10472+7adc332a
mariadb-devel< 3:10.3.28-1.module+el8.2.0+10474+c7510d9c | < 3:10.3.28-1.module+el8.1.0+10475+47ea4373 | < 3:10.3.28-1.module+el8.3.0+10472+7adc332a
mariadb-embedded< 3:10.3.28-1.module+el8.2.0+10474+c7510d9c | < 3:10.3.28-1.module+el8.1.0+10475+47ea4373 | < 3:10.3.28-1.module+el8.3.0+10472+7adc332a
mariadb-embedded-debuginfo< 3:10.3.28-1.module+el8.2.0+10474+c7510d9c | < 3:10.3.28-1.module+el8.1.0+10475+47ea4373 | < 3:10.3.28-1.module+el8.3.0+10472+7adc332a
mariadb-embedded-devel< 3:10.3.28-1.module+el8.2.0+10474+c7510d9c | < 3:10.3.28-1.module+el8.1.0+10475+47ea4373 | < 3:10.3.28-1.module+el8.3.0+10472+7adc332a
mariadb-errmsg< 3:10.1.20-3.el7ost | < 3:10.3.28-1.module+el8.2.0+10474+c7510d9c | < 3:10.3.28-1.module+el8.1.0+10475+47ea4373 | < 3:10.3.28-1.module+el8.3.0+10472+7adc332a
mariadb-gssapi-server< 3:10.3.28-1.module+el8.2.0+10474+c7510d9c | < 3:10.3.28-1.module+el8.1.0+10475+47ea4373 | < 3:10.3.28-1.module+el8.3.0+10472+7adc332a
mariadb-gssapi-server-debuginfo< 3:10.3.28-1.module+el8.2.0+10474+c7510d9c | < 3:10.3.28-1.module+el8.1.0+10475+47ea4373 | < 3:10.3.28-1.module+el8.3.0+10472+7adc332a
mariadb-libs< 3:10.1.20-3.el7ost
mariadb-oqgraph-engine< 3:10.3.28-1.module+el8.2.0+10474+c7510d9c | < 3:10.3.28-1.module+el8.1.0+10475+47ea4373 | < 3:10.3.28-1.module+el8.3.0+10472+7adc332a
mariadb-oqgraph-engine-debuginfo< 3:10.3.28-1.module+el8.2.0+10474+c7510d9c | < 3:10.3.28-1.module+el8.1.0+10475+47ea4373 | < 3:10.3.28-1.module+el8.3.0+10472+7adc332a
mariadb-server< 3:10.1.20-3.el7ost | < 3:10.3.28-1.module+el8.2.0+10474+c7510d9c | < 3:10.3.28-1.module+el8.1.0+10475+47ea4373 | < 3:10.3.28-1.module+el8.3.0+10472+7adc332a
mariadb-server-debuginfo< 3:10.3.28-1.module+el8.2.0+10474+c7510d9c | < 3:10.3.28-1.module+el8.1.0+10475+47ea4373 | < 3:10.3.28-1.module+el8.3.0+10472+7adc332a
mariadb-server-galera< 3:10.1.20-3.el7ost | < 3:10.3.28-1.module+el8.2.0+10474+c7510d9c | < 3:10.3.28-1.module+el8.1.0+10475+47ea4373 | < 3:10.3.28-1.module+el8.3.0+10472+7adc332a
mariadb-server-utils< 3:10.3.28-1.module+el8.2.0+10474+c7510d9c | < 3:10.3.28-1.module+el8.1.0+10475+47ea4373 | < 3:10.3.28-1.module+el8.3.0+10472+7adc332a
mariadb-server-utils-debuginfo< 3:10.3.28-1.module+el8.2.0+10474+c7510d9c | < 3:10.3.28-1.module+el8.1.0+10475+47ea4373 | < 3:10.3.28-1.module+el8.3.0+10472+7adc332a
mariadb-test< 3:10.1.20-3.el7ost | < 3:10.3.28-1.module+el8.2.0+10474+c7510d9c | < 3:10.3.28-1.module+el8.1.0+10475+47ea4373 | < 3:10.3.28-1.module+el8.3.0+10472+7adc332a
mariadb-test-debuginfo< 3:10.3.28-1.module+el8.2.0+10474+c7510d9c | < 3:10.3.28-1.module+el8.1.0+10475+47ea4373 | < 3:10.3.28-1.module+el8.3.0+10472+7adc332a
rh-mariadb103-galera< 0:25.3.32-2.el7
rh-mariadb103-galera-debuginfo< 0:25.3.32-2.el7
rh-mariadb103-mariadb< 3:10.3.28-2.el7
rh-mariadb103-mariadb-backup< 3:10.3.28-2.el7
rh-mariadb103-mariadb-backup-syspaths< 3:10.3.28-2.el7
rh-mariadb103-mariadb-common< 3:10.3.28-2.el7
rh-mariadb103-mariadb-config< 3:10.3.28-2.el7
rh-mariadb103-mariadb-config-syspaths< 3:10.3.28-2.el7
rh-mariadb103-mariadb-connect-engine< 3:10.3.28-2.el7
rh-mariadb103-mariadb-debuginfo< 3:10.3.28-2.el7
rh-mariadb103-mariadb-devel< 3:10.3.28-2.el7
rh-mariadb103-mariadb-errmsg< 3:10.3.28-2.el7
rh-mariadb103-mariadb-gssapi-server< 3:10.3.28-2.el7
rh-mariadb103-mariadb-oqgraph-engine< 3:10.3.28-2.el7
rh-mariadb103-mariadb-server< 3:10.3.28-2.el7
rh-mariadb103-mariadb-server-galera< 3:10.3.28-2.el7
rh-mariadb103-mariadb-server-galera-syspaths< 3:10.3.28-2.el7
rh-mariadb103-mariadb-server-syspaths< 3:10.3.28-2.el7
rh-mariadb103-mariadb-server-utils< 3:10.3.28-2.el7
rh-mariadb103-mariadb-server-utils-syspaths< 3:10.3.28-2.el7
rh-mariadb103-mariadb-syspaths< 3:10.3.28-2.el7
rh-mariadb103-mariadb-test< 3:10.3.28-2.el7

Show all 56

Chainguard8 products

percona-server-8.0All versions (No fix recorded)
percona-server-8.4All versions (No fix recorded)
percona-server-9.0All versions (No fix recorded)
percona-server-9.1All versions (No fix recorded)
percona-server-9.4All versions (No fix recorded)

Show all 8

Wolfi4 products

percona-server-8.4All versions (No fix recorded)
percona-server-9.1All versions (No fix recorded)
percona-server-9.5All versions (No fix recorded)
percona-server-9.6All versions (No fix recorded)

Debian3 products

mariadb-10.1< 10.1.48-0+deb9u2
mariadb-10.5< 1:10.5.9-1
debian_linuxEOL9.0

Ubuntu3 products

mariadb-10.1All versions (No fix recorded)
mariadb-10.3All versions (No fix recorded)
percona-server-5.6All versions (No fix recorded)

Alpine1 product

mariadb≥ 10.2, < 10.3.28-r0 | ≥ 10.2, < 10.4.18-r0 | ≥ 10.2, < 10.5.9-r0

Galeracluster1 product

wsrep≤ 2021-03-03

Mariadb1 product

mariadb≥ 10.2, < 10.2.37 | ≥ 10.3, < 10.3.28 | ≥ 10.4, < 10.4.18 | ≥ 10.5, < 10.5.9

Percona1 product

percona_server≤ 2021-03-03

9 vendors · 78 products

References

27 links

mariadb.com/kb/en/security/X Refsource MISCREPORTAdvisoryVendor Advisory
jira.mariadb.org/browse/MDEV-25179X Refsource MISCREPORTIssue TrackingVendor Advisory
mariadb.com/kb/en/mariadb-10237-release-notes/X Refsource MISCARTICLEREPORTAdvisoryRelease NotesVendor Advisory
mariadb.com/kb/en/mariadb-10328-release-notes/X Refsource MISCARTICLEREPORTAdvisoryRelease NotesVendor Advisory
mariadb.com/kb/en/mariadb-10418-release-notes/X Refsource MISCARTICLEREPORTAdvisoryRelease NotesVendor Advisory
mariadb.com/kb/en/mariadb-1059-release-notes/X Refsource MISCARTICLEREPORTAdvisoryRelease NotesVendor Advisory
lists.debian.org/debian-lts-announce/2021/03/msg00028.htmlMailing ListX Refsource MLISTAdvisoryThird Party Advisory
packetstormsecurity.com/files/162177/MariaDB-10.2-Command-Execution.htmlX Refsource MISCEVIDENCEExploitThird Party AdvisoryVDB Entry
security.gentoo.org/glsa/202105-28Vendor AdvisoryX Refsource GENTOOAdvisoryThird Party Advisory
security.alpinelinux.org/vuln/CVE-2021-27928Advisory

Show all 27 references

access.redhat.com/errata/RHSA-2021:1039Advisory
access.redhat.com/security/updates/classification/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=1940909REPORT
security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_1039.jsonAdvisory
access.redhat.com/security/cve/CVE-2021-27928REPORT
www.cve.org/CVERecord?id=CVE-2021-27928AdvisoryREPORT
nvd.nist.gov/vuln/detail/CVE-2021-27928AdvisoryOval
access.redhat.com/errata/RHSA-2021:1240Advisory
security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_1240.jsonAdvisory
access.redhat.com/errata/RHSA-2021:1241Advisory
security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_1241.jsonAdvisory
access.redhat.com/errata/RHSA-2021:1242Advisory
security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_1242.jsonAdvisory
access.redhat.com/errata/RHSA-2021:2040Advisory
security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_2040.jsonAdvisory
ubuntu.com/security/CVE-2021-27928REPORT
security-tracker.debian.org/tracker/CVE-2021-27928Advisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities