MariaDB Enterprise Server Maintenance Releases

By Daniel Bartholomew

7 Sep 20266 min read

New security maintenance releases for MariaDB Enterprise Server: 11.8.9-6, 11.4.13-10, and 10.6.28-24 are now available. While these releases were originally scheduled for September 14th, we have made them available ahead of schedule in order to address security vulnerabilities.

Download Now

Notable Release Updates

MariaDB Enterprise Server 11.8.9-6

MariaDB Enterprise Server 11.8.9-6 Release Notes
State Snapshot Transfer (SST) can now use different TLS certificates, keys and CAs depending on the node’s role in the transfer, for the mariabackup and rsync SST methods. This lets a single instance present a client certificate when it acts as the donor (TLS client) and a server certificate when it acts as the joiner (TLS server)
When a Galera node’s state snapshot transfer (SST) was configured for encryption, either through an explicit ssl-mode or through SSL certificates in the configuration, but the encryption could not actually be established, the rsync and mariabackup SST methods silently transferred the donor’s data in cleartext: rsync when the stunnel binary was not installed, and mariabackup when no usable SSL certificate and key were found, the SST now aborts with an error in these situations instead of falling back to an unencrypted transfer
Galera state transfers (SST) now interpret the ssl-mode=VERIFY_CA setting as documented: a node’s certificate must come from a trusted certificate authority, but its name no longer has to match the server’s address; previously, VERIFY_CA was incorrectly treated as strictly as VERIFY_IDENTITY, which could block state transfers between healthy nodes whose certificates did not name their hosts; deployments that want the stricter name matching should set ssl-mode=VERIFY_IDENTITY explicitly
Proxy protocol connections from remote host leaked memory, if DNS name resolution is allowed (skip_name_resolve is not set)
Updated HELP system documentation and urls to the MariaDB Documentation
The error log associated when libaio failed to setup an asynchronous kernel interface was incorrect; it now reports the error code, a text version, and a reference to the manual page that shows a correction
This release incorporates Galera library version 26.4.27
This release incorporates MariaDB ColumnStore storage engine version 25.10.6
Other various security and bug fixes

MariaDB Enterprise Server 11.4.13-10

MariaDB Enterprise Server 11.4.13-10 Release Notes
State Snapshot Transfer (SST) can now use different TLS certificates, keys and CAs depending on the node’s role in the transfer, for the mariabackup and rsync SST methods. This lets a single instance present a client certificate when it acts as the donor (TLS client) and a server certificate when it acts as the joiner (TLS server)
When a Galera node’s state snapshot transfer (SST) was configured for encryption, either through an explicit ssl-mode or through SSL certificates in the configuration, but the encryption could not actually be established, the rsync and mariabackup SST methods silently transferred the donor’s data in cleartext: rsync when the stunnel binary was not installed, and mariabackup when no usable SSL certificate and key were found, the SST now aborts with an error in these situations instead of falling back to an unencrypted transfer
Galera state transfers (SST) now interpret the ssl-mode=VERIFY_CA setting as documented: a node’s certificate must come from a trusted certificate authority, but its name no longer has to match the server’s address; previously, VERIFY_CA was incorrectly treated as strictly as VERIFY_IDENTITY, which could block state transfers between healthy nodes whose certificates did not name their hosts; deployments that want the stricter name matching should set ssl-mode=VERIFY_IDENTITY explicitly
Proxy protocol connections from remote host leaked memory, if DNS name resolution is allowed (skip_name_resolve is not set)
Updated HELP system documentation and urls to the MariaDB Documentation
The error log associated when libaio failed to setup an asynchronous kernel interface was incorrect; it now reports the error code, a text version, and a reference to the manual page that shows a correction
This release incorporates Galera library version 26.4.27
This release incorporates MariaDB ColumnStore storage engine version 25.10.6
Other various security and bug fixes

MariaDB Enterprise Server 10.6.28-24

MariaDB Enterprise Server 10.6.28-24 Release Notes
State Snapshot Transfer (SST) can now use different TLS certificates, keys and CAs depending on the node’s role in the transfer, for the mariabackup and rsync SST methods. This lets a single instance present a client certificate when it acts as the donor (TLS client) and a server certificate when it acts as the joiner (TLS server)
When a Galera node’s state snapshot transfer (SST) was configured for encryption, either through an explicit ssl-mode or through SSL certificates in the configuration, but the encryption could not actually be established, the rsync and mariabackup SST methods silently transferred the donor’s data in cleartext: rsync when the stunnel binary was not installed, and mariabackup when no usable SSL certificate and key were found, the SST now aborts with an error in these situations instead of falling back to an unencrypted transfer
Galera state transfers (SST) now interpret the ssl-mode=VERIFY_CA setting as documented: a node’s certificate must come from a trusted certificate authority, but its name no longer has to match the server’s address; previously, VERIFY_CA was incorrectly treated as strictly as VERIFY_IDENTITY, which could block state transfers between healthy nodes whose certificates did not name their hosts; deployments that want the stricter name matching should set ssl-mode=VERIFY_IDENTITY explicitly
Proxy protocol connections from remote host leaked memory, if DNS name resolution is allowed (skip_name_resolve is not set)
This release incorporates Galera library version 26.4.27
This release incorporates MariaDB ColumnStore storage engine version 25.10.6
Other various security and bug fixes

Why MariaDB Enterprise Server

MariaDB Enterprise Server is an enhanced, hardened and secured version of MariaDB Community Server that delivers enterprise reliability, stability and long-term support as well as greater operational efficiency when it comes to managing large database deployments for business and mission critical applications. MariaDB Enterprise Server offers additional features needed for production workloads that are not available in the community edition, such as Enterprise Audit and Enterprise Backup, and also backports certain enterprise features to older versions so customers can take advantage of critical fixes and features immediately instead of having to upgrade to the newest version.

Being able to backport features from newer release series to older versions is a key advantage of MariaDB Enterprise Server. Quality assurance and internal processes do not always allow customers to upgrade production environments to the newest and greatest release series, although some of the new features would be of value. MariaDB Enterprise Server can help in this case, as we can backport highly requested features to existing versions in cases where we can assure that a backported feature does not decrease the stability of that release series of MariaDB Enterprise Server.