ELSA-2023-2621: Security update for 7 packages

ELSA-2023-2621, released May 17, 2023, fixes 37 CVEs across 7 products. None of them is reported as exploited. Patch Radar priority: High.

High

CVEs closed

None rated Critical

Exploited

None reported

Highest CVSS

7.5

Base score, 0 to 10

Highest EPSS

0.4340

98th percentile

Priority of the 37 CVEs

Patch now 0
                                Urgent 0
                                High 37
                                Routine 0

Fixed package versions

Product	Release	Fixed in
mysql	ol 9	0:8.0.32-1.el9_2
mysql-common	ol 9	0:8.0.32-1.el9_2
mysql-devel	ol 9	0:8.0.32-1.el9_2
mysql-errmsg	ol 9	0:8.0.32-1.el9_2
mysql-libs	ol 9	0:8.0.32-1.el9_2
mysql-server	ol 9	0:8.0.32-1.el9_2
mysql-test	ol 9	0:8.0.32-1.el9_2

CVEs this fix closes

Priority	CVE	Title	CVSS	EPSS	Exploitation
High	CVE-2023-21887	libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: GIS)	7.5	0.4340	None reported
High	CVE-2022-21608	libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: Optimizer)	7.5	0.0174	None reported
High	CVE-2022-21617	libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: Connection Handling)	7.5	0.0174	None reported
High	CVE-2022-39408	libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: Optimizer)	7.5	0.0153	None reported
High	CVE-2022-39410	mysql-testsuite-8.0: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer)	7.5	0.0153	None reported
High	CVE-2023-21875	libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: Security: Encryption)	7.5	0.0152	None reported
High	CVE-2022-21594	libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: Optimizer)	7.5	0.0148	None reported
High	CVE-2022-21599	libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: Stored Procedure)	7.5	0.0148	None reported
High	CVE-2022-21604	libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB)	7.5	0.0148	None reported
High	CVE-2022-21632	libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: Security: Privileges)	7.5	0.0148	None reported
High	CVE-2022-21633	libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: Replication)	7.5	0.0148	None reported
High	CVE-2022-21637	libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:InnoDB)	7.5	0.0146	None reported
High	CVE-2022-21640	libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: Optimizer)	7.5	0.0146	None reported
High	CVE-2022-39400	libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: Optimizer)	7.5	0.0146	None reported
High	CVE-2022-21625	libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: Optimizer)	7.5	0.0135	None reported
High	CVE-2023-21912	libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: Security: Privileges)	7.5	0.0117	None reported
High	CVE-2023-21864	libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: Optimizer)	7.5	0.0116	None reported
High	CVE-2023-21865	libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: Optimizer)	7.5	0.0116	None reported
High	CVE-2023-21917	libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: Optimizer)	7.5	0.0113	None reported
High	CVE-2023-21874	libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: Thread Pooling)	7.5	0.0104	None reported
High	CVE-2023-21868	libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: Optimizer)	7.5	0.0091	None reported
High	CVE-2023-21863	mysql-server: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: Optimizer)	7.5	0.0088	None reported
High	CVE-2023-21867	libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: Optimizer)	7.5	0.0088	None reported
High	CVE-2023-21870	libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:Server: Optimizer)	7.5	0.0088	None reported
High	CVE-2023-21871	libmysqlclient21: Vulnerability in the MySQL Server product of Oracle MySQL (component:InnoDB)	7.5	0.0088	None reported

Also fixes CVE-2023-21887

RLSA-2023:3087
mecab, mecab-ipadic on rocky 8
ALSA-2023:3087
mecab, mecab-devel, mecab-ipadic and 8 more on almalinux 8
RHSA-2023:3087
mecab, mecab-devel, mecab-ipadic and 8 more on RHEL 8
RHSA-2023:2621
mysql, mysql-common, mysql-devel and 4 more on RHEL 9
ELSA-2023-3087
mecab, mecab-devel, mecab-ipadic and 8 more on ol 8
ALSA-2023:2621
mysql, mysql-common, mysql-devel and 4 more on almalinux 9
libmysqlclient21 8.0.32-0ubuntu2
libmysqlclient21 on Ubuntu 24.10 (oracular)
mysql-client 8.0.32-0ubuntu2
mysql-client on Ubuntu 24.10 (oracular)

Vendor advisory

https://linux.oracle.com/errata/ELSA-2023-2621.html

For tools and AI agents

This page as data: JSON · Markdown

Link to this page

If this page saved you time, a link to it in your ticket, advisory or write-up helps others find it.

HTML

<a href="https://patchblox.com/security/fix/linux/elsa-2023-2621">ELSA-2023-2621 on Patchblox Patch Radar</a>

Reusing the data? How to credit Patch Radar.

Which servers are still behind?

Patchblox compares the installed package on every Linux machine against the fixed version for its release, including machines reported through Azure Update Manager.

Get a demo

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.