CVE-2022-27380

Name	CVE-2022-27380
Description	An issue in the component my_decimal::operator= of MariaDB Server v10.6.3 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL statements.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-3114-1

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin
mariadb-10.1	source	(unstable)	(unfixed)
mariadb-10.3	source	buster	1:10.3.36-0+deb10u1	DLA-3114-1
mariadb-10.3	source	(unstable)	(unfixed)
mariadb-10.5	source	bullseye	1:10.5.18-0+deb11u1
mariadb-10.5	source	(unstable)	(unfixed)
mariadb-10.6	source	(unstable)	1:10.6.8-1

Notes

MariaDB bug: https://jira.mariadb.org/browse/MDEV-26280
MariaDB bug (main): https://jira.mariadb.org/browse/MDEV-25994
Fixed in MariaDB 10.2.44, 10.3.35, 10.4.25, 10.5.16, 10.6.8, 10.7.4, 10.8.3, 10.9.1
MariaDB commit: https://github.com/MariaDB/server/commit/3c209bfc040ddfc41ece8357d772547432353fd2 (10.2.44)