What is the used zlib-version on xtradb cluster (innoDB)?

sasi · June 5, 2023, 8:02am

Hi! I’m using the docker-image of Percona XtraDB Cluster of version 8.0.29-21.1 and stumbled over the following Announcement:

There is CVE-2022-37434 listed. MySQL seems to compile zlib for InnoDB separately maintained inside the repository itself. If i read this right, you have this on xtradb-cluster as well percona-xtradb-cluster/utilities/CMakeLists.txt at 636b3c0aa912ac4764beb12f09c8c190b351baed · percona/percona-xtradb-cluster · GitHub

What i don’t understand is, what zlib library you’re using. If i read this right,you’re using the system library, instad of the bundled one?:

github.com

percona/percona-xtradb-cluster/blob/636b3c0aa912ac4764beb12f09c8c190b351baed/cmake/zlib.cmake#L27


      
          # GNU General Public License, version 2.0, for more details.
          #
          # You should have received a copy of the GNU General Public License
          # along with this program; if not, write to the Free Software
          # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301  USA 
          
          # Usage:
          #  cmake -DWITH_ZLIB="bundled"|"system"
          #
          # Default is "bundled".
          # The default should be "system" on non-windows platforms,
          # but we need at least version 1.2.11, and that's not available on
          # all the platforms we need to support.
          
          # With earier versions, several compression tests fail.
          # SET(MIN_ZLIB_VERSION_REQUIRED "1.2.11")
          
          # Security bug fixes required from:
          SET(MIN_ZLIB_VERSION_REQUIRED "1.2.12")
          
          MACRO(FIND_ZLIB_VERSION)

Also, if this is the case, the version says 8.0.29-21.1.el8 on the docker-image for ENV FULL_PERCONA_XTRADBCLUSTER_VERSION=8.0.29-21.1.el8
. Does this mean, you’re using the zlib version of red hat named zlib-1.2.11-20.el8.x86_64?

tl;dr: Does InnoDB on percona-xtradbcluster of version 8.0.29-21.2.el8 in the docker-image percona/percona-xtradb-cluster:8.0.29-21.1 use the bundled zlib library or the system library? And if it is the second case, does it use zlib-1.2.11-20.el8.x86_64? Reason is CVE-2022-37434 and nosyness

Thanks for accepting my curiosity here

EDIT: formatting.