Improper input validation in MySQL Connectors - CVE-2020-2875

Vulnerability identifier: #VU26943

CSH Severity: Medium

CVSS v4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-2875

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Connector/J component in MySQL Connectors. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

MySQL Connectors
Gentoo Linux
SUSE OpenStack Cloud Crowbar
SUSE OpenStack Cloud
HPE Helion Openstack
SUSE Linux Enterprise Software Development Kit
Fedora
mysql-connector-java (Debian package)
mysql-connector-java
Fuse

Install updates from vendor's website.

MySQL Connectors - update to 8.0.15
mysql-connector-java (Debian package) - update to 5.1.49-0+deb9u1
mysql-connector-java - update to 5.1.42-5.7.1
Fuse - update to 7.10.0
mysql-connector-java - addressed in versions 8.0.21-1.fc32, 8.0.21-1.fc33

• https://www.oracle.com/security-alerts/cpuapr2020.html

• Multiple vulnerabilities in MySQL Connectors
• Debian update for mysql-connector-java
• Gentoo update for MySQL
• SUSE update for mysql-connector-java
• Multiple vulnerabilities in Fuse 7.10
• Fedora 33 update for mysql-connector-java
• Fedora 32 update for mysql-connector-java