GHSA-4rch-2fh8-94vw

Source

https://github.com/advisories/GHSA-4rch-2fh8-94vw

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/04/GHSA-4rch-2fh8-94vw/GHSA-4rch-2fh8-94vw.json

Aliases

• CVE-2024-21511

Published

2024-04-23T06:30:47Z

Modified

2024-04-23T21:11:53.942953Z

Summary

MySQL2 for Node Arbitrary Code Injection

Details

Versions of the package mysql2 before 3.9.7 are vulnerable to Arbitrary Code Injection due to improper sanitization of the timezone parameter in the readCodeFor function by calling a native MySQL Server date/time function.

References

• https://nvd.nist.gov/vuln/detail/CVE-2024-21511
• https://github.com/sidorares/node-mysql2/pull/2608
• https://github.com/sidorares/node-mysql2/commit/7d4b098c7e29d5a6cb9eac2633bfcc2f0f1db713
• https://github.com/sidorares/node-mysql2
• https://github.com/sidorares/node-mysql2/releases/tag/v3.9.7
• https://security.snyk.io/vuln/SNYK-JS-MYSQL2-6670046