Improper input validation in MySQL Connectors - CVE-2022-21363

Vulnerability identifier: #VU59737

CSH Severity: Medium

CVSS v4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-21363

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote privileged user to execute arbitrary code.

The vulnerability exists due to improper input validation within the Connector/J component in MySQL Connectors. A remote privileged user can exploit this vulnerability to execute arbitrary code.

MySQL Connectors
Red Hat Process Automation Manager (formerly JBoss BPM Suite)
JBoss Enterprise Application Platform
IBM Business Automation Manager Open Editions
openEuler
Fedora
mysql
mysql-connector-java
IBM InfoSphere Information Server

Install updates from vendor's website.

MySQL Connectors - update to 8.0.28
Red Hat Process Automation Manager (formerly JBoss BPM Suite) - update to 7.13.1
JBoss Enterprise Application Platform - update to 7.4.5
IBM Business Automation Manager Open Editions - update to 8.0.1
mysql - update to 8.0.28-1
mysql-connector-java - update to 8.0.28-1.fc35
mysql-connector-java - update to 8.0.30-1
IBM InfoSphere Information Server - update to 11.7.1.4 Service pack 1

• https://www.oracle.com/security-alerts/cpujan2022.html

• Multiple vulnerabilities in MySQL Connectors
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform
• Multiple vulnerabilities in Red Hat Process Automation Manager
• Multiple vulnerabilities in IBM Business Automation Manager Open Editions
• Multiple vulnerabilities in IBM InfoSphere Information Server
• openEuler update for mysql
• openEuler update for mysql-connector-java
• Fedora 35 update for mysql-connector-java