Gordan Bobic via discuss <[email protected]> writes: > Hi, I've been working on mapping CVE fixes in 10.6.x for the purpose > of backporting the fixes recently. These two in 10.6.28 have me a > little suspicious: > CVE-2026-60585 > CVE-2026-60184
>From the CVE description, these both concern the case where the attacker is able to craft arbitrary replication events and cause a slave server to execute them. The report mentions the ability to fully take over the server and/or bringing it down until restarted. However, this capability is inherent in the ability to control the replication stream. The slave must replicate _all_ changes done on the master, including ie. creating a custom root account or basically anything that could happen on the master, so this is already "full takeover" by the nature of what replication means. The only extra capability I have seen discussed is if the system is relying on secure_file_priv for containerising an untrusted MariaDB server on a trusted host, due to RCE. It is not mentioned in the two CVEs that this would be the case, and as you omitted the specific commits I cannot tell if it would apply. My recommendation would be that this recent stream of "vulnerabilities" that we have seen regarding specially crafted replication events, you should not include in your 10.6 maintenance branch. You can also check the branch knielsen_log_event_read_validation and the mailing list thread: https://lists.mariadb.org/hyperkitty/list/[email protected]/thread/JXEAZRR2LVVZHWPXYJUW7KGYNCAWU2T7/ This is a large patch, and fixing these in 10.6 is probably more risk than benefit. But it is also possible that you basically have to fix anything that's gotten the "CVE" mark due to the politics around "security" these days, and if so that's a reasonable pragmatic solution also. > I'm working on backporting that 12-patch set to my private 10.6.x > post-EOL maintenance branch, but I'd be happy to sync up with someone > closer to the validation process off-list to verify (or disprove) my > suspicions.. I think maintaining a 10.6 maintenance branch is a very valuable contribution. You write it is your "private branch", but I would hope you would be making it available to others? I would be happy to help you with any technical issues (like resolving merge conflicts etc.). We also need to make sure that you are included in any communication around vulnerability fixing that happens before the normal MariaDB releases outside of the public channels, so that release of those fixes can be coordinated and you not having to scramble only after a normal release is dumped on you. - Kristian. _______________________________________________ discuss mailing list -- [email protected] To unsubscribe send an email to [email protected]
