Release date:
2026-10-02 20:09:34 UTC
Description:
* SECURITY UPDATE: unauthenticated XCom client_msg injection in Group
Replication
- debian/patches/CVE-2026-60163.patch: reject application, transaction,
view and other cargo types received on an external XCom client
connection in acceptor_learner_task(), xcom_base.cc (upstream
BUG#39234600).
- CVE-2026-60163
* SECURITY UPDATE: applier privilege-check bypass via client BINLOG
- debian/patches/CVE-2026-61094.patch: decide whether the applier
privilege checks apply from whether the Relay_log_info belongs to a
client, not from the BINLOG payload length (>= 2048 bytes skipped
them), in Applier_security_context_guard, sql/rpl_rli.cc (upstream
Bug#39474825).
- CVE-2026-61094
Updated packages:
-
libperconaserverclient21_8.0.46-37-1.noble+tuxcare.els2_amd64.deb
sha:ac269b6ea1718b40643a8c5aa7fcb0eca58bf2eb
-
libperconaserverclient21-dev_8.0.46-37-1.noble+tuxcare.els2_amd64.deb
sha:1e360593c0e513a11097a579e1678c7c96d162c8
-
percona-mysql-router_8.0.46-37-1.noble+tuxcare.els2_amd64.deb
sha:a15b95818e08021d72ce3e6485ef662bd16eeb4b
-
percona-server-client_8.0.46-37-1.noble+tuxcare.els2_amd64.deb
sha:fa88320311af8ad104e1e3aabc70bfbfa62ffa53
-
percona-server-common_8.0.46-37-1.noble+tuxcare.els2_amd64.deb
sha:c9f10f1790e978c4120e5390e3b79bc5c3df5695
-
percona-server-rocksdb_8.0.46-37-1.noble+tuxcare.els2_amd64.deb
sha:13ae9628aa0a4603142424a422e7d71c36ad440b
-
percona-server-server_8.0.46-37-1.noble+tuxcare.els2_amd64.deb
sha:c46e9be2e5ef3a271d0845e18da2b690eeef926a
-
percona-server-source_8.0.46-37-1.noble+tuxcare.els2_amd64.deb
sha:911acedc9c50b47e962497a80ec5bdc9d1c74a44
-
percona-server-test_8.0.46-37-1.noble+tuxcare.els2_amd64.deb
sha:66b701657fd871cd6479bde779cfac6bb09005d4
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
