Improper input validation in MySQL Connectors - CVE-2020-2933

Vulnerability identifier: #VU26948

CSH Severity: Low

CVSS v4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-2933

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote privileged user to perform service disruption.

The vulnerability exists due to improper input validation within the Connector/J component in MySQL Connectors. A remote privileged user can exploit this vulnerability to perform service disruption.

MySQL Connectors
Gentoo Linux
SUSE OpenStack Cloud Crowbar
SUSE OpenStack Cloud
HPE Helion Openstack
SUSE Linux Enterprise Software Development Kit
Fedora
mysql-connector-java (Debian package)
mysql-connector-java

Install updates from vendor's website.

mysql-connector-java (Debian package) - update to 5.1.49-0+deb9u1
mysql-connector-java - update to 5.1.42-5.7.1
mysql-connector-java - addressed in versions 8.0.21-1.fc32, 8.0.21-1.fc33

• https://www.oracle.com/security-alerts/cpuapr2020.html

• Multiple vulnerabilities in MySQL Connectors
• Debian update for mysql-connector-java
• Gentoo update for MySQL
• SUSE update for mysql-connector-java
• Fedora 33 update for mysql-connector-java
• Fedora 32 update for mysql-connector-java