Improper input validation in MySQL Connectors - CVE-2020-2934

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU26918

Improper input validation in MySQL Connectors - CVE-2020-2934

Published: April 15, 2020


Vulnerability identifier: #VU26918
CSH Severity: Medium
CVSS v4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-2934
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Connector/J component in MySQL Connectors. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.


Affected software

MySQL Connectors
Gentoo Linux
SUSE OpenStack Cloud Crowbar
SUSE OpenStack Cloud
HPE Helion Openstack
SUSE Linux Enterprise Software Development Kit
Fedora
mysql-connector-java (Debian package)
mysql-connector-java
Oracle WebLogic Server
Fuse
IBM InfoSphere Information Server

How to mitigate CVE-2020-2934

Install updates from vendor's website.

mysql-connector-java (Debian package) - update to 5.1.49-0+deb9u1
mysql-connector-java - update to 5.1.42-5.7.1
Fuse - update to 7.10.0
mysql-connector-java - addressed in versions 8.0.21-1.fc32, 8.0.21-1.fc33
IBM InfoSphere Information Server - update to 11.7.1.4 Service pack 1

External References

Related Security Bulletins