VDB
ALPINE-CVE-2021-27928
ALPINE-CVE-2021-27928
PUBLISHED
CVSS 7.199999809265137 HIGH
A remote code execution issue was discovered in MariaDB 10.2 before 10.2.37, 10.3 before 10.3.28, 10.4 before 10.4.18, and 10.5 before 10.5.9; Percona Server through 2021-03-03; and the wsrep patch through 2021-03-03 for MySQL. An untrusted search path leads to eval injection, in which a database SUPER user can execute OS commands after modifying wsrep_provider and wsrep_notify_cmd. NOTE: this does not affect an Oracle product.
Risk Scores
CVSS 3.1
7.199999809265137
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Alpine:v3.13 | mariadb | 10.0.21-r0, 10.2.14-r0, 10.5.6-r0 |
| Alpine:v3.10 | mariadb | 0, 10.0.21-r0, 10.0.21-r1 |
| Alpine:v3.20 | mariadb | 5.5.43-r4, 10.2, 5.5.43-r5 |
| Alpine:v3.14 | mariadb | 10.1.9-r1, 10.1.19-r0, 10.3.15-r0 |
| Alpine:v3.22 | mariadb | 10.0.21-r1, 10.0.21-r0, 10.1.17-r1 |
| Alpine:v3.24 | mariadb | 10.2 |
| Alpine:v3.11 | mariadb | 10.3.12-r1, 0, 10.0.21-r0 |
| Alpine:v3.16 | mariadb | 5.5.41-r2, 5.5.42-r0, 5.5.42-r1 |
| Alpine:v3.18 | mariadb | 5.5.41-r2, 10.3.12-r0, 10.3.12-r1 |
| Alpine:v3.23 | mariadb | 10.1.31-r0, 10.1.8-r0, 10.1.8-r1 |
| Alpine:v3.19 | mariadb | 10.3.13-r4, 10.3.13-r2, 10.3.13-r1 |
| Alpine:v3.15 | mariadb | 10.3.10-r1, 10.3.10-r0, 10.2.15-r0 |
| Alpine:v3.21 | mariadb | 10.3.9-r2, 10.4.6-r1, 0 |
| Alpine:v3.17 | mariadb | 10.1.22-r0, 10.2, 5.5.43-r5 |
| Alpine:v3.12 | mariadb | 5.5.41-r0, 10.2, 5.5.43-r5 |
Timeline
- Mar 19, 2021 CVE Published
- Apr 30, 2026 Distribution Patch
- Jul 8, 2026 CVE Updated