CVE-2022-27448

Name	CVE-2022-27448
Description	There is an Assertion failure in MariaDB Server v10.9 and below via 'node->pcur->rel_pos == BTR_PCUR_ON' at /row/row0mysql.cc.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-3114-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
mariadb-10.5 (PTS)	bullseye	1:10.5.23-0+deb11u1	fixed
	bullseye (security)	1:10.5.26-0+deb11u2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin
mariadb-10.1	source	(unstable)	(unfixed)
mariadb-10.3	source	buster	1:10.3.36-0+deb10u1	DLA-3114-1
mariadb-10.3	source	(unstable)	(unfixed)
mariadb-10.5	source	bullseye	1:10.5.18-0+deb11u1
mariadb-10.5	source	(unstable)	(unfixed)
mariadb-10.6	source	(unstable)	1:10.6.8-1

Notes

MariaDB bug: https://jira.mariadb.org/browse/MDEV-28095
MariaDB fixed in version: 10.3.35, 10.4.25, 10.5.16, 10.6.8, 10.7.4
MariaDB commit: https://github.com/MariaDB/server/commit/ecb6f9c894d3ebafeff1c6eb3b65cd248062296f (mariadb-10.3.35)