GHSA-fpw7-j2hg-69v5

Source

https://github.com/advisories/GHSA-fpw7-j2hg-69v5

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/04/GHSA-fpw7-j2hg-69v5/GHSA-fpw7-j2hg-69v5.json

Aliases

• CVE-2024-21508

Published

2024-04-11T06:30:35Z

Modified

2024-04-12T14:13:52.978459Z

Summary

mysql2 Remote Code Execution (RCE) via the readCodeFor function

Details

Versions of the package mysql2 before 3.9.4 are vulnerable to Remote Code Execution (RCE) via the readCodeFor function due to improper validation of the supportBigNumbers and bigNumberStrings values.

References

• https://nvd.nist.gov/vuln/detail/CVE-2024-21508
• https://github.com/sidorares/node-mysql2/pull/2572
• https://github.com/sidorares/node-mysql2/commit/74abf9ef94d76114d9a09415e28b496522a94805
• https://blog.slonser.info/posts/mysql2-attacker-configuration
• https://github.com/sidorares/node-mysql2
• https://github.com/sidorares/node-mysql2/blob/1609b5393516d72a4ae47196837317fbe75e0c13/lib/parsers/text_parser.js%23L14C10-L14C21
• https://github.com/sidorares/node-mysql2/releases/tag/v3.9.4
• https://security.snyk.io/vuln/SNYK-JS-MYSQL2-6591085