Cloudanix VulnDB

CVE-2025-21505

None

CVSS

—

EPSS

1.1%

Published

Jan 21, 2025

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in the database server lets certain trusted users with network access crash or freeze the service, causing temporary outages until fixed by updates.

Exploitation
Remote Authenticated
Attacker needs
High Privilege
Complexity
Low
Impact
Denial Of Service
Component
Network Service
Class
Denial of service
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

High-privileged network attacker can trigger a hang or repeatable crash in the Server: Components Services component, resulting in complete denial of service for the database process.

Why it matters to the business

Results in unplanned database outages that disrupt dependent applications and services; low exploitation likelihood and no ransomware usage reduce urgency despite broad package exposure across Ubuntu LTS releases.

How an attack unfolds

An authenticated high-privileged user with network access sends crafted requests over supported protocols to the affected component, causing the server to hang or crash without requiring user interaction or additional privileges beyond those already held.

How to fix it

Upgrade affected packages to the following fixed versions: libphp-adodb (Ubuntu:Pro:16.04:LTS) to 5.20.3-1ubuntu1+esm1, libphp-adodb (Ubuntu:Pro:18.04:LTS) to 5.20.9-1ubuntu0.1~esm1, libphp-adodb (Ubuntu:22.04:LTS) to 5.20.19-1ubuntu0.1, libphp-adodb (Ubuntu:Pro:20.04:LTS) to 5.20.16-1ubuntu0.1~esm1. Apply the updates and restart the MySQL service.

How to confirm the fix worked

Verify package versions match the fixed releases listed above, confirm the MySQL server process remains stable under load after upgrade, and re-test connectivity from high-privileged accounts.

Typical attack path

  1. Obtain high-privileged network credentials for the MySQL instance
  2. Establish a connection using one of the supported protocols
  3. Transmit specially crafted requests targeting the Components Services layer
  4. Trigger repeated crashes or a persistent hang to achieve denial of service

How to detect it

Review authentication and query logs for unusual high-privileged sessions around the time of any observed database crashes or hangs; correlate with system process termination events.

What your security team should do

  • Prioritize patching Ubuntu systems running the listed libphp-adodb packages within standard change windows
  • Review and restrict high-privileged network accounts to the minimum required set
  • Monitor EPSS and KEV updates for any future increase in exploit activity

The record

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Components Services). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and 9.1.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

Affected packages

Ecosystem Package Introduced Fixed
AlmaLinux:8 mecab 0 0.996-2.module_el8.10.0+3965+b415b607
AlmaLinux:8 mecab 0 0.996-2.module_el8.6.0+3340+d764b636
AlmaLinux:8 mecab-devel 0 0.996-2.module_el8.10.0+3965+b415b607
AlmaLinux:8 mecab-devel 0 0.996-2.module_el8.6.0+3340+d764b636
AlmaLinux:8 mecab-ipadic 0 2.7.0.20070801-17.module_el8.10.0+3965+b415b607
AlmaLinux:8 mecab-ipadic-EUCJP 0 2.7.0.20070801-17.module_el8.10.0+3965+b415b607
AlmaLinux:8 mysql 0 8.0.41-1.module_el8.10.0+3965+b415b607
AlmaLinux:8 mysql-common 0 8.0.41-1.module_el8.10.0+3965+b415b607
AlmaLinux:8 mysql-devel 0 8.0.41-1.module_el8.10.0+3965+b415b607
AlmaLinux:8 mysql-errmsg 0 8.0.41-1.module_el8.10.0+3965+b415b607
AlmaLinux:8 mysql-libs 0 8.0.41-1.module_el8.10.0+3965+b415b607
AlmaLinux:8 mysql-server 0 8.0.41-1.module_el8.10.0+3965+b415b607
AlmaLinux:8 mysql-test 0 8.0.41-1.module_el8.10.0+3965+b415b607
AlmaLinux:9 mysql 0 8.0.41-2.el9_5
AlmaLinux:9 mysql-common 0 8.0.41-2.el9_5
AlmaLinux:9 mysql-devel 0 8.0.41-2.el9_5
AlmaLinux:9 mysql-errmsg 0 8.0.41-2.el9_5
AlmaLinux:9 mysql-libs 0 8.0.41-2.el9_5
AlmaLinux:9 mysql-server 0 8.0.41-2.el9_5
AlmaLinux:9 mysql-test 0 8.0.41-2.el9_5
Rocky Linux:8 mecab 0 0:0.996-2.module+el8.10.0+1676+9b4b6e24
Rocky Linux:8 mecab-ipadic 0 0:2.7.0.20070801-17.module+el8.10.0+1937+28fbbc83
Rocky Linux:8 mysql 0 0:8.0.41-1.module+el8.10.0+1937+28fbbc83.0.1
Rocky Linux:9 mysql 0 0:8.0.41-2.el9_5
Ubuntu:14.04:LTS mysql-5.5 0 No fix
Ubuntu:16.04:LTS mariadb-10.0 0 No fix
Ubuntu:16.04:LTS percona-server-5.6 0 No fix
Ubuntu:16.04:LTS percona-xtradb-cluster-5.6 0 No fix
Ubuntu:18.04:LTS mariadb-10.1 0 No fix
Ubuntu:20.04:LTS mariadb-10.3 0 No fix
Ubuntu:20.04:LTS mysql-8.0 0 No fix
Ubuntu:20.04:LTS mysql-8.0 0 8.0.41-0ubuntu0.20.04.1
Ubuntu:22.04:LTS mariadb-10.6 0 No fix
Ubuntu:22.04:LTS mysql-8.0 0 No fix
Ubuntu:22.04:LTS mysql-8.0 0 8.0.41-0ubuntu0.22.04.1
Ubuntu:24.04:LTS mariadb 0 No fix
Ubuntu:24.04:LTS mysql-8.0 0 No fix
Ubuntu:24.04:LTS mysql-8.0 0 8.0.41-0ubuntu0.24.04.1
Ubuntu:24.10 mariadb 0 No fix
Ubuntu:24.10 mysql-8.0 0 No fix
Ubuntu:25.04 mariadb 0 No fix
Ubuntu:25.10 mariadb 0 No fix
Ubuntu:Pro:14.04:LTS mysql-5.5 0 No fix
Ubuntu:Pro:16.04:LTS mariadb-10.0 0 No fix
Ubuntu:Pro:16.04:LTS mysql-5.7 0 No fix
Ubuntu:Pro:16.04:LTS percona-server-5.6 0 No fix
Ubuntu:Pro:16.04:LTS percona-xtradb-cluster-5.6 0 No fix
Ubuntu:Pro:18.04:LTS mariadb-10.1 0 No fix
Ubuntu:Pro:18.04:LTS mysql-5.7 0 No fix
Ubuntu:Pro:20.04:LTS mariadb-10.3 0 No fix

Related vulnerabilities