Description:
* SECURITY UPDATE: backport a curated candidate set of security-relevant bugfixes from
the 9.0 end-of-life window 9.1.0 (Oct 2024; patches 2024_bugfix01..05,
applied before the 2025/2026 CVE patch series). This is candidate-set
pool coverage for the oct2024 CPU CVEs for which Oracle publishes no
per-CVE fix attribution; it is a curated subset, not a complete
backport of every 9.1.0-window commit.
* SECURITY UPDATE: the two oct2024 Client: mysqldump CVEs are not
claimed by this set: their fix (mysqldump server-version
sanitization, first published for the supported lines in
8.0.40/8.4.3/9.1.0) is already present in the 9.0.1 base sources
this package is built from. The related EOL-window patch for the
mysqldump command-escaping hardening (upstream also backported it
to the 8.0/5.7 series) is likewise not added separately: the
identical fix already ships as debian/patches/CVE-2025-30722.patch,
applied earlier in the series; no 2024_bugfix07 patch is added, to
avoid duplicating it.
* SECURITY UPDATE: extend the candidate-set pool with two further fixes
previously deferred as conflicting, now hand-backported: end-range check
with multi-value indexes (2024_bugfix08, Bug#36341532) and the
materialize-iterator spill-state assertion series, parts 1-4 plus
follow-up squashed (2024_bugfix09, Bug#36739383).
Addresses: CVE-2024-21194, CVE-2024-21199, CVE-2024-21201,
CVE-2024-21213, CVE-2024-21218, CVE-2024-21230, CVE-2024-21236,
CVE-2024-21239, CVE-2024-21241
* NOT AFFECTED: CVE-2024-21238 (Server: Thread Pooling) is dropped from
this set. The Thread Pool connection handler it describes is an Oracle
Enterprise-only component (plugin/thread_pool) and is not present in the
MySQL Community source tree this package is built from, so the Community
build is not affected; the oct2024 ELSDOCKER variants for 21238 are
re-triaged not-affected rather than patched.
* NOT AFFECTED: CVE-2024-21243 and CVE-2024-21244 (Server: Telemetry) are
likewise not claimed by this set (review follow-up): the telemetry
traces/metrics services they describe live in the Oracle Enterprise-only
component_telemetry; none of the shipped patches touch telemetry code and
no candidate fix exists in the Oct-2024 CPU window for the Community tree,
so the Community build is not affected. Their oct2024 ELSDOCKER variants
are re-triaged not-affected rather than patched.
* SECURITY UPDATE: user-variable memory-root use-after-reset in the
Statement handle interface
- debian/patches/2024_bugfix11-bug36892945.patch: save and restore
THD::user_var_events_alloc around sub-statement execution in
Regular_statement_handle::execute() and
Prepared_statement_handle::internal_execute(), so a statement executed
through the Statement handle after a stored procedure (which leaves
user_var_events_alloc at nullptr) no longer operates on a stale memory
root. Upstream Bug#36892945, first published in 8.4.3 / 9.1.0 only; it is
absent from the 8.0 series because the sql/statement/ handle service was
introduced after 8.0, matching this CVE's fixed-in versions exactly
(8.0 is not affected).
- CVE-2024-21232
* SECURITY HARDENING: memory leak in the component string service
- debian/patches/2024_bugfix10-bug36600205.patch: free the String buffer
allocated by convert_from_buffer() when the requested character set is
unknown or the conversion fails, instead of leaking it on the error
path. Upstream Bug#36600205 (8.0.40 / 8.4.3 / 9.1.0), retained as an
EOL-window hardening fix; not claimed as the CVE-2024-21232 fix (that
bug was fixed in 8.0.40, whereas CVE-2024-21232 does not affect 8.0).
* SECURITY UPDATE: complete the oct2024 candidate set (review follow-up):
backport the remaining InnoDB and Optimizer crash fixes from the
9.0.1->9.1.0 EOL window that reviewers identified as members of the
same candidate pool, so the shipped set is no longer a strict subset:
- debian/patches/2024_bugfix12-bug36677952.patch: InnoDB, assertion
dict0dict.cc table->get_ref_count()==0 when killing DDL on
partitioned tables (upstream 4496e7b8c4c, 9.1.0).
- debian/patches/2024_bugfix13-bug36840107.patch: InnoDB, crash after
UPDATE inplace on INSTANT-DDL redundant-row-format table
(upstream a5d9ec9028c, 8.0.40/9.1.0).
- debian/patches/2024_bugfix14-bug36723117.patch: InnoDB, crash using
a secondary index after dropping a column with ALGORITHM=INSTANT
(upstream c79a2fb4005, 8.0.40/9.1.0).
- debian/patches/2024_bugfix15-bug36730830.patch: InnoDB redo, assertion
log0files_governor.cc it != log.m_files.end() on redo truncate
(upstream 946081c811c, 8.0.40/9.1.0).
- debian/patches/2024_bugfix16-bug35854686.patch: Optimizer, server
crash in JOIN::update_depend_map(ORDER*) (upstream aedfac0a672, 9.1.0).
- debian/patches/2024_bugfix17-bug36444257.patch: Optimizer, assertion
`false' in operator at sql/sql_executor.cc for const GROUP BY item
under WITH ROLLUP + window function (upstream 3cf4ccfb655, 9.1.0;
mtr test blocks re-appended for the 9.0.1 olap.test/result tails).
- debian/patches/2024_bugfix18-bug36804785.patch: Optimizer, same
assertion for const-for-execution GROUP BY items (follow-up to
Bug#36444257; upstream a88b802a4f7, 9.1.0; same mtr adaptation).
- debian/patches/2024_bugfix19-bug36492114.patch: Optimizer, stored
procedure crash 0xc0000005 via optimizer-hint use-after-free
(upstream 234262f5cfd, 9.1.0).
- debian/patches/2024_bugfix20-bug36562979.patch: crash at
VarintParse64() (upstream 173b3e34876, 8.4.3/9.1.0).
Addresses: CVE-2024-21194, CVE-2024-21199, CVE-2024-21201,
CVE-2024-21213, CVE-2024-21218, CVE-2024-21230, CVE-2024-21236,
CVE-2024-21239, CVE-2024-21241
