CVE-2022-47015

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-01-20 · updated 2026-06-17
Weakness: CWE-476

Description

MariaDB Server before 10.3.34 thru 10.9.3 is vulnerable to Denial of Service. It is possible for function spider_db_mbase::print_warnings to dereference a null pointer.

Affected products

MariaDB: from 10.3.0 before 10.3.39; from 10.4.0 before 10.4.29; from 10.5.0 before 10.5.20; from 10.6.0 before 10.6.13; from 10.8.0 before 10.8.8; from 10.9.0 before 10.9.6 — fixed in 10.10.4, 10.11.3, 10.3.39, 10.4.29, 10.5.20, 10.6.13

How to fix

Upgrade to a fixed version: MariaDB 10.10.4, 10.11.3, 10.3.39, 10.4.29. Check the vendor advisory for mitigations.

References

https://github.com/MariaDB/server/commit/be0a46b3d52b58956fd0d47d040b9f4514406954
https://lists.debian.org/debian-lts-announce/2023/06/msg00005.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O22PO3Q6TRSNJI2A2WTJH3VVCHEKBF6C/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SUQ33SPQCZQD63TWAM3XKFNVNFRGPFYU/
https://security.netapp.com/advisory/ntap-20230309-0009/
https://github.com/MariaDB/server/commit/be0a46b3d52b58956fd0d47d040b9f4514406954
https://lists.debian.org/debian-lts-announce/2023/06/msg00005.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O22PO3Q6TRSNJI2A2WTJH3VVCHEKBF6C/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SUQ33SPQCZQD63TWAM3XKFNVNFRGPFYU/
https://security.netapp.com/advisory/ntap-20230309-0009/

Get alerted when CVE-2022-47015 or the next vulnerability affects your stack