GHSA-4whx-7p29-mq22

Suggest an improvement
Source
https://github.com/advisories/GHSA-4whx-7p29-mq22
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/06/GHSA-4whx-7p29-mq22/GHSA-4whx-7p29-mq22.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-4whx-7p29-mq22
Aliases
Related
Published
2022-06-06T21:22:28Z
Modified
2023-11-08T04:09:22.474008Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
TiDB authentication bypass vulnerability
Details

Impact

Under certain conditions, an attacker can construct malicious authentication requests to bypass the authentication process, resulting in privilege escalation or unauthorized access. Only users using TiDB 5.3.0 are affected by this vulnerability.

Patches

Please upgrade to TiDB 5.3.1 or higher version

Workarounds

You can also mitigate risks by taking the following measures. Option 1: Turn off SEM (Security Enhanced Mode). Option 2: Disable local login for non-root accounts and ensure that the same IP cannot be logged in as root or normal user at the same time.

References

https://en.pingcap.com/download/

For more information

If you have any questions or comments about this advisory: * Email us at security@tidb.io

Database specific
{
    "nvd_published_at": "2022-05-31T20:15:00Z",
    "github_reviewed_at": "2022-06-06T21:22:28Z",
    "severity": "HIGH",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-287"
    ]
}
References

Affected packages

Go / github.com/pingcap/tidb

Package

Name
github.com/pingcap/tidb
View open source insights on deps.dev
Purl
pkg:golang/github.com/pingcap/tidb

Affected ranges

Type
SEMVER
Events
Introduced
5.3.0
Fixed
5.3.1

Affected versions

5.*

5.3.0