Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-39676

Galera Cluster-peer > Donor command execution

    XMLWordPrintable

Details

    • Can result in unexpected behaviour
    • Hide
      An appropriately privileged user (with SUPER privileges) could execute shell commands as the uid of the mariadbd process because the values of the system variables wsrep_sst_donor and wsrep_sst_receive_address, which can be modified at runtime, were not properly sanitized when used to construct a shell command.
      Show
      An appropriately privileged user (with SUPER privileges) could execute shell commands as the uid of the mariadbd process because the values of the system variables wsrep_sst_donor and wsrep_sst_receive_address, which can be modified at runtime, were not properly sanitized when used to construct a shell command.
    • Q3/2026 Replic. Maintenance

    Description

      System variables wsrep_sst_donor and wsrep_sst_receive_address can be modified at run time by a database user with SUPER privileges.

      Their values were not properly sanitized when used to construct a shell command, which allowed an appropriately privileged user to run shell commands as the uid of the mariadbd process

      Reported by letchu_pkt

      Attachments

        Issue Links

          relates to

          Bug - A problem which impairs or prevents the functions of the product. MDEV-25179 wsrep_provider and wsrep_notify_cmd system variables are writable

          • Blocker - Blocks development and/or testing work, production could not run.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. MDEV-39413 wsrep unsafe handling of parameters

          • Critical - Crashes, loss of data, severe memory leak.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. MDEV-39648 wsrep_sst_rsync.sh: apply safe() to joiner-supplied parameters

          • Critical - Crashes, loss of data, severe memory leak.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. MDEV-39721 wsrep_notify_cmd should sanitize peer-supplied fields before shell substitution

          • Critical - Crashes, loss of data, severe memory leak.
          • Closed
          links to

          Web Link CVE-2026-48165

          Activity

            People

              janlindstrom Jan Lindström
              janlindstrom Jan Lindström
              Votes:
              0 Vote for this issue
              Watchers:
              6 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Time Tracking

                  Estimated:
                  Original Estimate - 1d
                  1d
                  Remaining:
                  Remaining Estimate - 0d
                  0d
                  Logged:
                  Time Spent - 5.75h Time Not Required
                  5.75h

                  Git Integration

                    Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.