Bug 265468 - databases/mysql80-server: Update to 8.0.30 (Fixes several CVE)
Summary: databases/mysql80-server: Update to 8.0.30 (Fixes several CVE)
Status: Closed FIXED
Alias: None
Product: Ports & Packages
Classification: Unclassified
Component: Individual Port(s) (show other bugs)
Version: Latest
Hardware: Any Any
: --- Affects Many People
Assignee: Jochen Neumeister
URL: https://www.oracle.com/security-alert...
Keywords: patch, security
Depends on:
Blocks:
 
Reported: 2022-07-27 19:14 UTC by Markus Kohlmeyer
Modified: 2022-09-16 08:19 UTC (History)
3 users (show)

See Also:
bugzilla: maintainer-feedback? (joneum)


Attachments
databases/mysql80-server/files/my.cnf.sample.in (1.73 KB, text/plain)
2022-07-27 19:14 UTC, Markus Kohlmeyer
no flags Details
Patch to update to 8.0.30 (62.51 KB, patch)
2022-08-08 16:32 UTC, Markus Kohlmeyer
no flags Details | Diff
Patch to update to 8.0.30 (66.29 KB, patch)
2022-08-11 11:13 UTC, Markus Kohlmeyer
no flags Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Markus Kohlmeyer 2022-07-27 19:14:59 UTC
Created attachment 235509 [details]
databases/mysql80-server/files/my.cnf.sample.in

Oracle relesed MySQL Server 8.0.30
https://dev.mysql.com/doc/relnotes/mysql/8.0/en/news-8-0-30.html


Additionally i attached an updated databases/mysql80-server/files/my.cnf.sample.in as the/my old one was originally for MySQL 5.6/5.7 but is now partly outdated.
Comment 1 Markus Kohlmeyer 2022-07-29 00:56:42 UTC
Version 8.0.30 also fixes several CVE
https://www.oracle.com/security-alerts/cpujul2022.html#AppendixMSQL
Comment 2 Markus Kohlmeyer 2022-08-08 16:32:28 UTC
Created attachment 235780 [details]
Patch to update to 8.0.30

Patch to update to 8.0.30

+ Updated my.cnf.sample
Comment 3 Jochen Neumeister freebsd_committer freebsd_triage 2022-08-10 14:48:24 UTC
thx for this. Are you check the mysql80-client, too?
Comment 4 Jochen Neumeister freebsd_committer freebsd_triage 2022-08-10 17:03:13 UTC
https://joneumbox.org/data/131amd64-ports/2022-08-10_18h43m13s/logs/errors/mysql80-client-8.0.30.log


[ 34%] Building CXX object include/CMakeFiles/installed_headers.dir/installed_headers.cc.o
cd /wrkdirs/usr/ports/databases/mysql80-client/work/.build/include && /usr/bin/c++ -DHAVE_CONFIG_H -DLZ4_DISABLE_DEPRECATE_WARNINGS -DRAPIDJSON_NO_SIZETYPEDEFINE -DRAPIDJSON_SCHEMA_USE_INTERNALREGEX=0 -DRAPIDJSON_SCHEMA_USE_STDREGEX=1 -D_USE_MATH_DEFINES -D__STDC_FORMAT_MACROS -D__STDC_LIMIT_MACROS -I/wrkdirs/usr/ports/databases/mysql80-client/work/.build -I/wrkdirs/usr/ports/databases/mysql80-client/work/.build/include -I/wrkdirs/usr/ports/databases/mysql80-client/work/mysql-8.0.30 -I/wrkdirs/usr/ports/databases/mysql80-client/work/mysql-8.0.30/include -isystem /wrkdirs/usr/ports/databases/mysql80-client/work/mysql-8.0.30/extra/rapidjson/include -isystem /usr/local/include/editline -std=c++17 -fno-omit-frame-pointer -ftls-model=initial-exec -O2 -pipe  -fPIC -DNDEBUG -malign-double -fstack-protector-strong -DLDAP_DEPRECATED -isystem /usr/local/include -fno-strict-aliasing   -isystem /usr/local/include -std=c++17 -Wall -Wextra -Wformat-security -Wvla -Wundef -Wmissing-format-attribute -Woverloaded-virtual -Wcast-qual -Wno-null-conversion -Wno-unused-private-field -Wconditional-uninitialized -Wdeprecated -Wextra-semi -Wheader-hygiene -Wnon-virtual-dtor -Wundefined-reinterpret-cast -Winconsistent-missing-destructor-override -Winconsistent-missing-override -Wshadow-field -ffunction-sections -fdata-sections -O2 -pipe  -fPIC -DNDEBUG -malign-double -fstack-protector-strong -DLDAP_DEPRECATED -isystem /usr/local/include -fno-strict-aliasing   -isystem /usr/local/include -std=c++17 -fPIE -std=gnu++11 -MD -MT include/CMakeFiles/installed_headers.dir/installed_headers.cc.o -MF CMakeFiles/installed_headers.dir/installed_headers.cc.o.d -o CMakeFiles/installed_headers.dir/installed_headers.cc.o -c /wrkdirs/usr/ports/databases/mysql80-client/work/.build/include/installed_headers.cc
In file included from /wrkdirs/usr/ports/databases/mysql80-client/work/.build/include/installed_headers.cc:13:
/wrkdirs/usr/ports/databases/mysql80-client/work/mysql-8.0.30/include/big_endian.h:33:2: error: This file should never be #included directly; use my_byteorder.h.
#error This file should never be #included directly; use my_byteorder.h.
 ^
In file included from /wrkdirs/usr/ports/databases/mysql80-client/work/.build/include/installed_headers.cc:15:
/wrkdirs/usr/ports/databases/mysql80-client/work/mysql-8.0.30/include/caching_sha2_passwordopt-longopts.h:27:1: error: expected unqualified-id
{"server-public-key-path",
^
In file included from /wrkdirs/usr/ports/databases/mysql80-client/work/.build/include/installed_headers.cc:16:
/wrkdirs/usr/ports/databases/mysql80-client/work/mysql-8.0.30/include/caching_sha2_passwordopt-vars.h:36:12: error: use of undeclared identifier 'opt_server_public_key'; did you mean 'set_server_public_key'?
  else if (opt_server_public_key && *opt_server_public_key)
           ^~~~~~~~~~~~~~~~~~~~~
           set_server_public_key
/wrkdirs/usr/ports/databases/mysql80-client/work/mysql-8.0.30/include/caching_sha2_passwordopt-vars.h:32:13: note: 'set_server_public_key' declared here
static void set_server_public_key(MYSQL *mysql,
            ^
/wrkdirs/usr/ports/databases/mysql80-client/work/mysql-8.0.30/include/caching_sha2_passwordopt-vars.h:36:38: error: use of undeclared identifier 'opt_server_public_key'; did you mean 'set_server_public_key'?
  else if (opt_server_public_key && *opt_server_public_key)
                                     ^~~~~~~~~~~~~~~~~~~~~
                                     set_server_public_key
/wrkdirs/usr/ports/databases/mysql80-client/work/mysql-8.0.30/include/caching_sha2_passwordopt-vars.h:32:13: note: 'set_server_public_key' declared here
static void set_server_public_key(MYSQL *mysql,
            ^
/wrkdirs/usr/ports/databases/mysql80-client/work/mysql-8.0.30/include/caching_sha2_passwordopt-vars.h:36:12: warning: address of function 'set_server_public_key' will always evaluate to 'true' [-Wpointer-bool-conversion]
  else if (opt_server_public_key && *opt_server_public_key)
           ^~~~~~~~~~~~~~~~~~~~~ ~~
/wrkdirs/usr/ports/databases/mysql80-client/work/mysql-8.0.30/include/caching_sha2_passwordopt-vars.h:36:12: note: prefix with the address-of operator to silence this warning
  else if (opt_server_public_key && *opt_server_public_key)
           ^
           &
/wrkdirs/usr/ports/databases/mysql80-client/work/mysql-8.0.30/include/caching_sha2_passwordopt-vars.h:37:51: error: use of undeclared identifier 'opt_server_public_key'; did you mean 'server_public_key'?
    mysql_options(mysql, MYSQL_SERVER_PUBLIC_KEY, opt_server_public_key);
                                                  ^~~~~~~~~~~~~~~~~~~~~
                                                  server_public_key
/wrkdirs/usr/ports/databases/mysql80-client/work/mysql-8.0.30/include/caching_sha2_passwordopt-vars.h:33:47: note: 'server_public_key' declared here
                                  const char *server_public_key = nullptr) {
                                              ^
In file included from /wrkdirs/usr/ports/databases/mysql80-client/work/.build/include/installed_headers.cc:22:
In file included from /wrkdirs/usr/ports/databases/mysql80-client/work/mysql-8.0.30/include/ft_global.h:37:
In file included from /wrkdirs/usr/ports/databases/mysql80-client/work/mysql-8.0.30/include/m_ctype.h:42:
/wrkdirs/usr/ports/databases/mysql80-client/work/mysql-8.0.30/include/template_utils.h:213:32: error: no member named 'make_reverse_iterator' in namespace 'std'
  return std::find_if_not(std::make_reverse_iterator(last),
                          ~~~~~^
/wrkdirs/usr/ports/databases/mysql80-client/work/mysql-8.0.30/include/template_utils.h:214:32: error: no member named 'make_reverse_iterator' in namespace 'std'
                          std::make_reverse_iterator(first),
                          ~~~~~^
In file included from /wrkdirs/usr/ports/databases/mysql80-client/work/.build/include/installed_headers.cc:23:
In file included from /wrkdirs/usr/ports/databases/mysql80-client/work/mysql-8.0.30/include/heap.h:45:
In file included from /wrkdirs/usr/ports/databases/mysql80-client/work/mysql-8.0.30/include/my_tree.h:33:
/wrkdirs/usr/ports/databases/mysql80-client/work/mysql-8.0.30/include/my_alloc.h:482:27: error: no template named 'remove_const_t' in namespace 'std'; did you mean 'remove_const'?
    TRASH(const_cast<std::remove_const_t<T> *>(ptr), sizeof(T));
                     ~~~~~^~~~~~~~~~~~~~
                          remove_const
/usr/include/c++/v1/type_traits:673:50: note: 'remove_const' declared here
template <class _Tp> struct _LIBCPP_TEMPLATE_VIS remove_const            {typedef _Tp type;};
                                                 ^
In file included from /wrkdirs/usr/ports/databases/mysql80-client/work/.build/include/installed_headers.cc:24:
/wrkdirs/usr/ports/databases/mysql80-client/work/mysql-8.0.30/include/integer_digits.h:48:5: error: statement not allowed in constexpr constructor
    for (int i = 0; i < 100; ++i) {
    ^
/wrkdirs/usr/ports/databases/mysql80-client/work/mysql-8.0.30/include/integer_digits.h:73:35: error: no matching constructor for initialization of 'const TwoDigitWriter'
  static constexpr TwoDigitWriter writer;
                                  ^
/wrkdirs/usr/ports/databases/mysql80-client/work/mysql-8.0.30/include/integer_digits.h:45:7: note: candidate constructor (the implicit copy constructor) not viable: requires 1 argument, but 0 were provided
class TwoDigitWriter {
      ^
/wrkdirs/usr/ports/databases/mysql80-client/work/mysql-8.0.30/include/integer_digits.h:45:7: note: candidate constructor (the implicit move constructor) not viable: requires 1 argument, but 0 were provided
/wrkdirs/usr/ports/databases/mysql80-client/work/mysql-8.0.30/include/integer_digits.h:93:19: warning: variable declaration in a constexpr function is a C++14 extension [-Wc++14-extensions]
    constexpr int mid = (MinDigits + MaxDigits) / 2;
                  ^
/wrkdirs/usr/ports/databases/mysql80-client/work/mysql-8.0.30/include/integer_digits.h:94:17: warning: variable declaration in a constexpr function is a C++14 extension [-Wc++14-extensions]
    constexpr T pivot = pow10(mid);
                ^
/wrkdirs/usr/ports/databases/mysql80-client/work/mysql-8.0.30/include/integer_digits.h:95:5: warning: use of this statement in a constexpr function is a C++14 extension [-Wc++14-extensions]
    if (x < pivot)
    ^
/wrkdirs/usr/ports/databases/mysql80-client/work/mysql-8.0.30/include/integer_digits.h:98:7: warning: multiple return statements in constexpr function is a C++14 extension [-Wc++14-extensions]
      return DigitCounter<T, mid + 1, MaxDigits>()(x);
      ^
/wrkdirs/usr/ports/databases/mysql80-client/work/mysql-8.0.30/include/integer_digits.h:96:7: note: previous return statement is here
      return DigitCounter<T, MinDigits, mid>()(x);
      ^
/wrkdirs/usr/ports/databases/mysql80-client/work/mysql-8.0.30/include/integer_digits.h:103:7: warning: variable declaration in a constexpr function is a C++14 extension [-Wc++14-extensions]
    T x = 1;
      ^
/wrkdirs/usr/ports/databases/mysql80-client/work/mysql-8.0.30/include/integer_digits.h:104:5: error: statement not allowed in constexpr function
    for (int i = 0; i < n; ++i) x *= 10;
    ^
In file included from /wrkdirs/usr/ports/databases/mysql80-client/work/.build/include/installed_headers.cc:29:
/wrkdirs/usr/ports/databases/mysql80-client/work/mysql-8.0.30/include/little_endian.h:33:2: error: This file should never be #included directly; use my_byteorder.h.
#error This file should never be #included directly; use my_byteorder.h.
 ^
/wrkdirs/usr/ports/databases/mysql80-client/work/mysql-8.0.30/include/little_endian.h:48:21: error: redefinition of 'sint2korr'
static inline int16 sint2korr(const uchar *A) {
                    ^
/wrkdirs/usr/ports/databases/mysql80-client/work/mysql-8.0.30/include/big_endian.h:40:21: note: previous definition is here
static inline int16 sint2korr(const uchar *A) {
                    ^
In file included from /wrkdirs/usr/ports/databases/mysql80-client/work/.build/include/installed_headers.cc:29:
/wrkdirs/usr/ports/databases/mysql80-client/work/mysql-8.0.30/include/little_endian.h:54:21: error: redefinition of 'sint4korr'
static inline int32 sint4korr(const uchar *A) {
                    ^
/wrkdirs/usr/ports/databases/mysql80-client/work/mysql-8.0.30/include/big_endian.h:44:21: note: previous definition is here
static inline int32 sint4korr(const uchar *A) {
                    ^
In file included from /wrkdirs/usr/ports/databases/mysql80-client/work/.build/include/installed_headers.cc:29:
/wrkdirs/usr/ports/databases/mysql80-client/work/mysql-8.0.30/include/little_endian.h:60:22: error: redefinition of 'uint2korr'
static inline uint16 uint2korr(const uchar *A) {
                     ^
/wrkdirs/usr/ports/databases/mysql80-client/work/mysql-8.0.30/include/big_endian.h:49:22: note: previous definition is here
static inline uint16 uint2korr(const uchar *A) {
                     ^
In file included from /wrkdirs/usr/ports/databases/mysql80-client/work/.build/include/installed_headers.cc:29:
/wrkdirs/usr/ports/databases/mysql80-client/work/mysql-8.0.30/include/little_endian.h:66:22: error: redefinition of 'uint4korr'
static inline uint32 uint4korr(const uchar *A) {
                     ^
/wrkdirs/usr/ports/databases/mysql80-client/work/mysql-8.0.30/include/big_endian.h:53:22: note: previous definition is here
static inline uint32 uint4korr(const uchar *A) {
                     ^
In file included from /wrkdirs/usr/ports/databases/mysql80-client/work/.build/include/installed_headers.cc:29:
/wrkdirs/usr/ports/databases/mysql80-client/work/mysql-8.0.30/include/little_endian.h:72:25: error: redefinition of 'uint8korr'
static inline ulonglong uint8korr(const uchar *A) {
                        ^
/wrkdirs/usr/ports/databases/mysql80-client/work/mysql-8.0.30/include/big_endian.h:58:25: note: previous definition is here
static inline ulonglong uint8korr(const uchar *A) {
                        ^
In file included from /wrkdirs/usr/ports/databases/mysql80-client/work/.build/include/installed_headers.cc:29:
/wrkdirs/usr/ports/databases/mysql80-client/work/mysql-8.0.30/include/little_endian.h:78:24: error: redefinition of 'sint8korr'
static inline longlong sint8korr(const uchar *A) {
                       ^
/wrkdirs/usr/ports/databases/mysql80-client/work/mysql-8.0.30/include/big_endian.h:66:24: note: previous definition is here
static inline longlong sint8korr(const uchar *A) {
                       ^
In file included from /wrkdirs/usr/ports/databases/mysql80-client/work/.build/include/installed_headers.cc:29:
/wrkdirs/usr/ports/databases/mysql80-client/work/mysql-8.0.30/include/little_endian.h:84:20: error: redefinition of 'int2store'
static inline void int2store(uchar *T, uint16 A) { memcpy(T, &A, sizeof(A)); }
                   ^
/wrkdirs/usr/ports/databases/mysql80-client/work/mysql-8.0.30/include/big_endian.h:70:20: note: previous definition is here
static inline void int2store(uchar *T, uint16 A) {
                   ^
fatal error: too many errors emitted, stopping now [-ferror-limit=]
6 warnings and 20 errors generated.
*** Error code 1

Stop.
make[3]: stopped in /wrkdirs/usr/ports/databases/mysql80-client/work/.build
*** Error code 1

Stop.
make[2]: stopped in /wrkdirs/usr/ports/databases/mysql80-client/work/.build
*** Error code 1

Stop.
make[1]: stopped in /wrkdirs/usr/ports/databases/mysql80-client/work/.build
*** Error code 1

Stop.
make: stopped in /usr/ports/databases/mysql80-client
=>> Cleaning up wrkdir
===>  Cleaning for mysql80-client-8.0.30
build of databases/mysql80-client | mysql80-client-8.0.30 ended at Wed Aug 10 18:45:11 CEST 2022
build time: 00:01:54
!!! build failure encountered !!!
Comment 5 Markus Kohlmeyer 2022-08-11 11:13:02 UTC
Created attachment 235844 [details]
Patch to update to 8.0.30

The buildissue is caused by https://cgit.freebsd.org/ports/commit/databases/mysql80-server/files/patch-include_CMakeLists.txt?id=342c784ae3cb74eeb87d281182060a1a31a1481c which i don't understand why it's done at all. Without that patch all builds and runs fine, so i excluded that patch from my new updated attached patch.

Maybe Jochen (Maintainer) knows more about it?
Comment 6 Jochen Neumeister freebsd_committer freebsd_triage 2022-08-11 11:35:28 UTC
(In reply to Markus Kohlmeyer from comment #5)

hi Markus, I will have a closer look tonight. Thanks for your great support
Comment 7 Markus Kohlmeyer 2022-08-23 11:54:57 UTC
(In reply to Jochen Neumeister from comment #6)

Any progress on this and the bugreport as a whole?
Comment 8 Jochen Neumeister freebsd_committer freebsd_triage 2022-08-26 08:05:33 UTC
sorry for the delay.

Currently there is still a problem with FreBSD 12.3 amd64:


CMake Error at cmake/zlib.cmake:136 (MESSAGE):
  ZLIB version must be at least 1.2.12, found 1.2.11.

  Please use -DWITH_ZLIB=bundled
Call Stack (most recent call first):
  CMakeLists.txt:1739 (MYSQL_CHECK_ZLIB)


I'll try to continue working on the update this weekend.
Comment 9 commit-hook freebsd_committer freebsd_triage 2022-09-15 14:36:20 UTC
A commit in branch main references this bug:

URL: https://cgit.FreeBSD.org/ports/commit/?id=b5daf80a266a031ac1299ec2107f53dac3f2c722

commit b5daf80a266a031ac1299ec2107f53dac3f2c722
Author:     Jochen Neumeister <joneum@FreeBSD.org>
AuthorDate: 2022-09-15 14:24:48 +0000
Commit:     Jochen Neumeister <joneum@FreeBSD.org>
CommitDate: 2022-09-15 14:34:27 +0000

    databases/mysql80-*: Update to latest release 8.0.30

    PR:     265468

    Bugs Fixed:
    - InnoDB: A TRUNCATE TABLE operation failed to remove data dictionary entries for columns that were dropped using ALGORITHM=INSTANT.
    - InnoDB: An incorrect nullable column calculation on tables with instantly added columns caused data to be interpreted incorrectly
    - InnoDB: The read_2_bytes() function in the InnoDB sources, which reads bytes from the log buffer, returned a null pointer.
    - Replication: The COUNT_TRANSACTIONS_REMOTE_IN_APPLIER_QUEUE column in the Performance Schema table replication_group_member_stats could persistently show transactions related to view change events (View_change_log_event) that had already been applied. These events are queued in the Group Replication applier channel but applied in the Group Replication recovery channel, causing a race condition that could result in the counter decrement being lost. The increment of the count now takes place at a more suitable point, and the counter for COUNT_TRANSACTIONS_REMOTE_IN_APPLIER_QUEUE is also now set to zero when the applier is not busy.
    - Debug MySQL binaries can now be built using -0g and -fno-inline.

    See full Changelog here: https://dev.mysql.com/doc/relnotes/mysql/8.0/en/news-8-0-30.html

    Sponsored by:   Netzkommune GmbH

 databases/mysql80-client/pkg-plist                 | 170 -------------------
 databases/mysql80-server/Makefile                  |   3 +-
 databases/mysql80-server/distinfo                  |   6 +-
 .../mysql80-server/files/patch-CMakeLists.txt      |  48 +++---
 .../mysql80-server/files/patch-cmake_ssl.cmake     |  36 ++--
 .../files/patch-include_CMakeLists.txt (gone)      | 185 ---------------------
 .../files/patch-include_violite.h (gone)           |  14 --
 .../files/patch-mysys_my__md5.cc (gone)            |  12 --
 ...m__network__provider__ssl_native__lib.cc (gone) |  20 ---
 ...tch-plugin_x_client_xconnection__impl.cc (gone) |  33 ----
 ..._src_harness_src_tls__server__context.cc (gone) |  12 --
 .../files/patch-scripts_CMakeLists.txt             |  12 +-
 .../files/patch-sql-common_client.cc (gone)        |  18 --
 databases/mysql80-server/files/patch-sql_mysqld.cc |  19 +--
 .../mysql80-server/files/patch-sql_sys__vars.cc    |  49 +-----
 .../files/patch-vio_viosslfactories.cc             |  45 +----
 databases/mysql80-server/pkg-plist                 |   1 +
 17 files changed, 67 insertions(+), 616 deletions(-)