Details
-
Bug
-
Status: Closed (View Workflow)
-
Critical
-
Resolution: Won't Fix
-
10.6.18
-
None
-
Linux
Description
https://github.com/MariaDB/server/commit/13663cb5c4
The SQL dumps generated by MariaDB 10.6.18 (MariaDB dump 10.19) contain:
/*!999999\- enable the sandbox mode */
|
This is a syntax error when importing to other versions of MariaDB or MySQL and therefore it breaks transfers between servers where the server version is not identical. When importing into older versions, you get:
ERROR at line 7: Unknown command '\-‘.
|
Attachments
Issue Links
- is caused by
-
-
- Closed
-
Activity
@rfay that's probably because deb12 jumped from 10.5 to the next LTS release 10.11 so I guess it makes no sense to provide any releases prior to 10.11 for deb12 bookworm?
# mariadb-dump --version
|
mariadb-dump Ver 10.19 Distrib 10.11.6-MariaDB, for debian-linux-gnu (x86_64) |
# ldd /usr/bin/mariadb-dump
|
linux-vdso.so.1 (0x00007fff0a31d000)
|
libssl.so.3 => /lib/x86_64-linux-gnu/libssl.so.3 (0x00007c4a05473000) |
libcrypto.so.3 => /lib/x86_64-linux-gnu/libcrypto.so.3 (0x00007c4a04ff1000) |
libz.so.1 => /lib/x86_64-linux-gnu/libz.so.1 (0x00007c4a04fd2000) |
libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007c4a04df1000) |
/lib64/ld-linux-x86-64.so.2 (0x00007c4a05a21000) |
@serg does that mean security relies on the malicious server being so nice to send
/*!999999\- enable the sandbox mode */
|
at the start of the dump?
And that older versions would only be able to import insecure files? This seems a bit backward to me.
No, the "enable the sandbox mode" line is added by the mariadb-dump, a server has no way to affect that.
ok, but it still relies on the dump being generated by a new version, so if you get a dump you'd have to check if the line is there and not malformed.
Considering that line is generated by default anyway, I'd think it would have made more sense to make sandbox mode the default except if a command line option is given by a privileged user (no inband signaling for security stuff).
True.
Yes, automatically it only applies to new dumps. Security-conscious users always use --binary-mode or the new --sandbox mode anyway.
Enabling the sandbox more by default was certainly possible, but I didn't want to break existing setups for users that use \-commands in scripts.
Note that Debian 12 Bookworm has moved on from libssl 1; and there don't seem to be MariaDB 10.6 downloads for mariadb-client for Debian Bookworm either in archive.mariadb.org or via the download page. So getting a usable mariadb-client/mariadb-dump for Bookworm doesn't seem possible right now.