Package: mariadb-server
Version: 1:10.11.18-0+deb12u1
Severity: important
Hello!
On Debian 12, after the upgrade to 1:10.11.18-0+deb12u1, I find that
mariadb.socket has been activated without any input or consent from me.
This results in mariadb-server now suddenly being available to *:3306
(i.e. the Internet if no firewall is configured) instead of just
127.0.0.1:3306.
This is very unfortunate, as this potentially exposes the server to attacks.
Here is how the state of the socket looks before and after the upgrade:
Pre-Upgrade:
○ mariadb.socket - MariaDB 10.11.14 database server (socket activation)
Loaded: loaded (/lib/systemd/system/mariadb.socket; static)
Active: inactive (dead)
Triggers: ● mariadb.service
Docs: man:mariadbd(8)
https://mariadb.com/kb/en/library/systemd/
Listen: @mariadb (Stream)
/run/mysqld/mysqld.sock (Stream)
[::]:3306 (Stream)
Post-Upgrade:
○ mariadb.socket - MariaDB 10.11.18 database server (socket activation)
Loaded: loaded (/lib/systemd/system/mariadb.socket; enabled; preset:
enabled)
Active: inactive (dead)
Triggers: ● mariadb.service
Docs: man:mariadbd(8)
https://mariadb.com/kb/en/library/systemd/
Listen: @mariadb (Stream)
/run/mysqld/mysqld.sock (Stream)
[::]:3306 (Stream)
After Reboot:
● mariadb.socket - MariaDB 10.11.18 database server (socket activation)
Loaded: loaded (/lib/systemd/system/mariadb.socket; enabled; preset:
enabled)
Active: active (running) since Mon 2026-07-13 06:53:13 CEST; 6s ago
Triggers: ● mariadb.service
Docs: man:mariadbd(8)
https://mariadb.com/kb/en/library/systemd/
Listen: @mariadb (Stream)
/run/mysqld/mysqld.sock (Stream)
[::]:3306 (Stream)
Tasks: 0 (limit: 9481)
Memory: 4.0K
CPU: 592us
CGroup: /system.slice/mariadb.socket
Jul 13 06:53:13 ml systemd[1]: Starting mariadb.socket - MariaDB 10.11.18
database server (socket activation)...
Jul 13 06:53:13 ml systemd[1]: Listening on mariadb.socket - MariaDB 10.11.18
database server (socket activation).
No manual change has been done my me, just "apt full-upgrade".
Because mariadbd is running at the moment, this won't have an effect
until rebooting the system, which is an additional wrinkle, masking the
new unsafe situation even further, obscuring the reason for the change.
Grüße,
Sven!
-- System Information:
Debian Release: 12.15
APT prefers oldstable-updates
APT policy: (500, 'oldstable-updates'), (500, 'oldstable-security'), (500,
'oldstable'), (100, 'oldoldstable-updates'), (100, 'oldoldstable-security'),
(100, 'oldoldstable')
Architecture: amd64 (x86_64)
Kernel: Linux 6.1.0-50-amd64 (SMP w/8 CPU threads; PREEMPT)
Locale: LANG=C.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
Versions of packages mariadb-server depends on:
ii adduser 3.134
ii debconf [debconf-2.0] 1.5.82
ii galera-4 26.4.23-0+deb12u1
ii gawk 1:5.2.1-2
ii iproute2 6.1.0-3
ii libc6 2.36-9+deb12u14
ii libdbi-perl 1.643-4+deb12u1
ii libgcc-s1 12.2.0-14+deb12u1
ii libpam0g 1.5.2-6+deb12u2
ii libssl3 3.0.20-1~deb12u2
ii libstdc++6 12.2.0-14+deb12u1
ii lsof 4.95.0-1
ii mariadb-client 1:10.11.18-0+deb12u1
ii mariadb-common 1:10.11.18-0+deb12u1
ii mariadb-server-core 1:10.11.18-0+deb12u1
ii passwd 1:4.13+dfsg1-1+deb12u2
ii perl 5.36.0-7+deb12u3
ii procps 2:4.0.2-3
ii psmisc 23.6-1
ii rsync 3.2.7-1+deb12u6
ii socat 1.7.4.4-2
ii zlib1g 1:1.2.13.dfsg-1
Versions of packages mariadb-server recommends:
ii libhtml-template-perl 2.97-2
ii mariadb-plugin-provider-bzip2 1:10.11.18-0+deb12u1
ii mariadb-plugin-provider-lz4 1:10.11.18-0+deb12u1
ii mariadb-plugin-provider-lzma 1:10.11.18-0+deb12u1
ii mariadb-plugin-provider-lzo 1:10.11.18-0+deb12u1
ii mariadb-plugin-provider-snappy 1:10.11.18-0+deb12u1
ii pv 1.6.20-1
Versions of packages mariadb-server suggests:
pn mariadb-test <none>
pn netcat-openbsd <none>
-- Configuration Files:
/etc/logcheck/ignore.d.paranoid/mariadb-server [Errno 13] Permission denied:
'/etc/logcheck/ignore.d.paranoid/mariadb-server'
/etc/logcheck/ignore.d.server/mariadb-server [Errno 13] Permission denied:
'/etc/logcheck/ignore.d.server/mariadb-server'
/etc/logcheck/ignore.d.workstation/mariadb-server [Errno 13] Permission denied:
'/etc/logcheck/ignore.d.workstation/mariadb-server'
/etc/mysql/mariadb.conf.d/50-server.cnf changed [not included]
-- debconf information excluded
