GHSA-wmxm-6wxc-3xqf

Suggest an improvement
Source
https://github.com/advisories/GHSA-wmxm-6wxc-3xqf
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/12/GHSA-wmxm-6wxc-3xqf/GHSA-wmxm-6wxc-3xqf.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-wmxm-6wxc-3xqf
Aliases
Published
2022-12-22T12:30:16Z
Modified
2023-11-08T04:10:51.367365Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Apache ShardingSphere-Proxy Incomplete Cleanup vulnerability
Details

Apache ShardingSphere-Proxy prior to 5.3.0 when using MySQL as database backend didn't cleanup the database session completely after client authentication failed, which allowed an attacker to execute normal commands by constructing a special MySQL client. This vulnerability has been fixed in Apache ShardingSphere 5.3.0.

References

Affected packages

Maven / org.apache.shardingsphere:shardingsphere-proxy

Package

Name
org.apache.shardingsphere:shardingsphere-proxy
View open source insights on deps.dev
Purl
pkg:maven/org.apache.shardingsphere/shardingsphere-proxy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.3.0

Affected versions

5.*

5.0.0
5.1.0
5.1.1
5.1.2
5.2.0
5.2.1