Enterprise Advisory Plugins

10.8 Enterprise Advisory Plugins

Available since: replication-manager v3.1.24

Enterprise advisory plugins are built-in — they are compiled into the repman binary and run on every instance without requiring external binaries. They match the running database and tool versions against a curated advisory database to surface known CVEs, replication bugs, and crash/performance issues.

10.8.1 Advisory Sources

The advisory database is assembled daily by the Signal18 back office from:

10.8.2 The Three Plugins

enterprise-security

Covers all known MariaDB/MySQL CVEs plus replication-manager GitHub security issues.

enterprise-replication

Covers replication subsystem bugs that cause silent data corruption, crash-safe parallel replication failures, or auto-increment divergence.

enterprise-workload

Covers CRITICAL and HIGH severity crash, deadlock, optimizer regression, and memory leak bugs not already covered by the other two plugins.

10.8.3 Version Matching

Each advisory entry carries two version fields:

The plugin checks the server version against this range:

• If the server version is below affected_from → not affected, no finding
• If the server version is at or above fixed_in → already patched, no finding
• Otherwise → finding emitted

Findings auto-resolve — when the database is upgraded past fixed_in the finding silently disappears on the next monitoring tick.

Non-database products

Advisories can also target non-database products using the flavor field:

10.8.4 Subscription Plan Gating

Back-office delivery

The advisory JSON is pushed daily to each registered instance's GitLab pull repository. The back office only pushes to paid plans (support, support-services, partner). Free-plan instances never receive updated files.

Plugin-side alert

When the subscription plan is free or unset, each enterprise plugin emits a persistent security error:

The embedded advisory database still runs — it just won't receive new CVEs discovered after the binary was built.

10.8.5 Configuration

No per-plugin configuration is needed. The advisory JSON is managed entirely by the back office.

The only control is the standard enable/disable toggle available in Settings → Plugins:

[mycluster.plugin-config.enterprise-security]
enabled = true   # default: true

[mycluster.plugin-config.enterprise-replication]
enabled = true

[mycluster.plugin-config.enterprise-workload]
enabled = true

10.8.6 GUI

• Settings → Plugins: enable/disable toggle and help description for each enterprise plugin
• Security button (navbar): shows the count of open security alerts (not the score letter)
• Security Score modal: score letter grade, open security states including enterprise findings
• Security Logs tab: full security log history including enterprise advisory findings

10.8.7 Advisory JSON Format

All three plugins use the same JSON schema. The file is stored at {ShareDir}/plugins/data/enterprise-{type}-issues.json.

{
  "version": "1",
  "generated_at": "2026-04-25T09:10:15Z",
  "source": "signal18-backoffice",
  "issues": [
    {
      "id": "ENT0001",
      "cve": "CVE-2022-27458",
      "mariadb_jira": "MDEV-26281",
      "github_issue": "",
      "severity": "SECURITY",
      "title": "MariaDB use-after-free in Binary_string::free_buffer()",
      "description": "Server {server_url} is running {flavor} {version} which is affected by ...",
      "flavor": "MariaDB",
      "affected_from": "10.7.0",
      "fixed_in": "10.7.3",
      "remediations": [
        {
          "type": "repman_config",
          "description": "Upgrade to MariaDB 10.7.3 or later.",
          "risk": "disruptive"
        }
      ]
    }
  ]
}

Description placeholders

Reference tags (CVE, MDEV, GitHub issue, fix version) are automatically appended to the description by the plugin.