The advisory details a security update for MySQL 8.0 on Red Hat Enterprise Linux 8, addressing numerous vulnerabilities identified by multiple CVEs. These include a buffer overread in OpenSSL (CVE-2024-5535), GSS message token handling in krb5 (CVE-2024-37371), ASN.1 date parser overread in libcurl (CVE-2024-7264), and a wide range of unspecified vulnerabilities in MySQL components such as Thread Pooling, X Plugin, Optimizer, Client programs, Information Schema, InnoDB, Group Replication, FTS, Health Monitor, DML, PS, DDL, mysqldump, Performance Schema, Privileges, Parser, and Packaging. Some vulnerabilities allow denial of service, unauthorized data modification, or privilege misuse. Red Hat has issued patches for these vulnerabilities as part of their October 2024 and January 2025 CPU updates. The advisory provides links to detailed CVE pages and instructions for applying updates.

The vulnerabilities collectively pose risks including potential buffer overreads, denial of service conditions, privilege misuse, unauthorized data modification, and other unspecified impacts within MySQL server components and related libraries. These issues could affect the confidentiality, integrity, and availability of the MySQL database service if exploited. The advisory rates the overall impact as Important, indicating significant security concerns but does not specify exploitation in the wild. The broad range of affected components suggests multiple attack surfaces within MySQL and its dependencies.

Red Hat has released updated packages for MySQL 8.0 as part of Red Hat Enterprise Linux 8 updates to address these vulnerabilities. Users should apply the security update RHSA-2025:1673 promptly to remediate the issues. Detailed instructions for applying the update are available at https://access.redhat.com/articles/11258. Since this is an on-premises product, administrators must manually deploy the patches. No indication is given that no action is required or that the issues are already mitigated without patching. Patch status is confirmed by the vendor advisory.