Main Vulnerability Database Vulnerabilities #VU57510

Improper input validation in MySQL Connectors - CVE-2021-2471

Published: October 19, 2021 / Updated: October 24, 2021

Vulnerability identifier: #VU57510

CSH Severity: Medium

CVSS v4: 5.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-2471

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: Public exploit is available

Vulnerability details

The vulnerability allows a remote privileged user to read data or crash the application.

The vulnerability exists due to improper input validation within the Connector/J component in MySQL Connectors. A remote privileged user can exploit this vulnerability to read data or crash the application.

Affected software

MySQL Connectors
Oracle Communications Cloud Native Core Security Edge Protection Proxy
Oracle Communications Cloud Native Core Network Slice Selection Function
Oracle Communications Cloud Native Core Console
Oracle Communications Cloud Native Core Policy
xxl-job
Red Hat Process Automation Manager (formerly JBoss BPM Suite)
HPE Helion Openstack
SUSE OpenStack Cloud
SUSE OpenStack Cloud Crowbar
SUSE Linux Enterprise Server
SUSE Linux Enterprise Software Development Kit
SUSE Linux Enterprise Server for SAP Applications
openEuler
Fedora
IBM Security Guardium
Red Hat Integration Camel-K
mysql-connector-java
mysql

How to mitigate CVE-2021-2471

Install updates from vendor's website.

MySQL Connectors - update to 8.0.27
xxl-job - update to 2.3.1
Red Hat Process Automation Manager (formerly JBoss BPM Suite) - update to 7.13.0
Red Hat Integration Camel-K - update to 1.8
mysql-connector-java - update to 8.0.25-5.13.1
mysql - addressed in versions 8.0.27-1, 8.0.28-1
mysql-connector-java - addressed in versions 8.0.27-1.fc35, 8.0.28-1.fc35
mysql-connector-java - update to 8.0.30-1

Links to Public Exploits and PoC-codes

External References

https://www.oracle.com/security-alerts/cpuoct2021.html