Improper input validation in MySQL Connectors - CVE-2022-1941

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU71261

Improper input validation in MySQL Connectors - CVE-2022-1941

Published: January 17, 2023


Vulnerability identifier: #VU71261
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-1941
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Connector/Python (Python) component in MySQL Connectors. A remote non-authenticated attacker can exploit this vulnerability to perform a denial of service (DoS) attack.


Affected software

MySQL Connectors
Amazon Linux AMI
Gentoo Linux
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE CaaS Platform
SUSE Manager Server
SUSE Linux Enterprise Module for SUSE Manager Server
SUSE Linux Enterprise Micro
openSUSE Leap Micro
SUSE Enterprise Storage
Ubuntu
SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS
Public Cloud Module
SUSE Linux Enterprise Server 15 SP1 LTSS
SUSE Linux Enterprise Server 15 SP2 LTSS
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Server
SUSE Linux Enterprise Module for Public Cloud
SUSE Linux Enterprise Installer
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise Module for Basesystem
SUSE Linux Enterprise Module for Development Tools
SUSE Linux Enterprise Server 15 SP3 LTSS
Basesystem Module
Server Applications Module
SUSE Package Hub 15
openSUSE Leap
openEuler
Fedora
Splunk Enterprise
IBM Security Guardium
SUSE Linux Enterprise Module for Packagehub Subpackages
libprotoc9v5 (Ubuntu package)
protobuf-compiler (Ubuntu package)
libprotoc8 (Ubuntu package)
libprotobuf8 (Ubuntu package)
libprotobuf-lite8 (Ubuntu package)
libprotobuf-lite9v5 (Ubuntu package)
python-protobuf (Ubuntu package)
libprotobuf9v5 (Ubuntu package)
python3-opencensus-context
python3-opencensus-ext-threading
python3-grpcio-gcp
python3-aiocontextvars
python2-grpcio-gcp
python3-Automat
python3-pytest-asyncio
python3-opencensus
python3-knack
perl-Alien-ProtoBuf
python3-Deprecated
python3-jsondiff
python2-jsondiff
python3-websocket-client
python3-opentelemetry-api
python3-googleapis-common-protos
python2-googleapis-common-protos
python3-avro
python3-google-api-core
grpc-debugsource
grpc-source
grpc-debuginfo
libgrpc++1-debuginfo
python3-grpcio-debuginfo
grpc-devel-debuginfo
python2-grpcio-debuginfo
python2-grpcio
grpc-devel
python3-grpcio
libgrpc8
libgrpc++1
libgrpc8-debuginfo
python3-PyGithub
azure-cli-core
python2-requests
python3-requests
libprotoc10 (Ubuntu package)
libprotobuf10 (Ubuntu package)
libprotobuf-lite10 (Ubuntu package)
python3-protobuf (Ubuntu package)
python3-cryptography-vectors
python2-cryptography-vectors
python2-cryptography
python3-cryptography
python-cryptography-debugsource
python3-cryptography-debuginfo
python2-cryptography-debuginfo
python-cryptography-debuginfo
libprotoc17 (Ubuntu package)
libprotobuf-lite17 (Ubuntu package)
libprotoc-dev (Ubuntu package)
libprotoc20
libprotoc20-debuginfo
protobuf-java
protobuf-debugsource
libprotobuf20-debuginfo
protobuf-devel-debuginfo
protobuf-devel
libprotobuf-lite20-debuginfo
python2-protobuf
libprotoc20-32bit
protobuf-source
libprotobuf-lite20
libprotobuf-lite20-32bit
libprotobuf20-32bit
libprotobuf20
python3-protobuf
libprotobuf-lite20-32bit-debuginfo
libprotobuf20-32bit-debuginfo
libprotoc20-32bit-debuginfo
python3-pytest
libprotobuf-java (Ubuntu package)
libprotobuf23 (Ubuntu package)
libprotoc23 (Ubuntu package)
libprotobuf-lite23 (Ubuntu package)
protobuf-lite
protobuf-javadoc
protobuf-debuginfo
protobuf
protobuf-lite-devel
protobuf-parent
protobuf-bom
protobuf-javalite
protobuf-java-util
protobuf-compiler
dev-python/protobuf-python
dev-libs/protobuf
python3-zope.interface-debuginfo
python-zope.interface-debuginfo
python-zope.interface-debugsource
python3-zope.interface
python3-psutil-debuginfo
python-psutil-debuginfo
python3-psutil
python2-psutil-debuginfo
python2-psutil
python-psutil-debugsource
python3-websockets-debuginfo
python-websockets-debugsource
python3-websockets
python2-humanfriendly
python3-humanfriendly
python3-constantly
python3-hyperlink
python3-incremental
python3-Twisted-debuginfo
python3-Twisted
IBM QRadar DNS Analyzer App
Spectrum Discover
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
IBM Watson Discovery for IBM Cloud Pak for Data
Automation Assets in IBM Cloud Pak for Integration (CP4I)
PowerStore T
IBM Cloud Pak for Watson AIOps
Dell EMC PowerStore Family Operating System
Robotic Process Automation for Cloud Pak
Dell EMC VxRail Appliance
Red Hat Ceph Storage
IBM App Connect Enterprise

How to mitigate CVE-2022-1941

Install updates from vendor's website.

MySQL Connectors - update to 8.0.32
Splunk Enterprise - addressed in versions 8.2.12, 9.0.6, 9.1.1
libprotoc9v5 (Ubuntu package) - update to Ubuntu Pro (Infra-only)
protobuf-compiler (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 3.0.0-9.1ubuntu1.1, 3.6.1.3-2ubuntu5.2, 3.12.4-1ubuntu7.22.04.1, 3.12.4-1ubuntu7.22.10.1
libprotoc8 (Ubuntu package) - update to Ubuntu Pro
libprotobuf8 (Ubuntu package) - update to Ubuntu Pro
libprotobuf-lite8 (Ubuntu package) - update to Ubuntu Pro
libprotobuf-lite9v5 (Ubuntu package) - update to Ubuntu Pro (Infra-only)
python-protobuf (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 3.0.0-9.1ubuntu1.1, 3.6.1.3-2ubuntu5.2
libprotobuf9v5 (Ubuntu package) - update to Ubuntu Pro (Infra-only)
python3-opencensus-context - update to 0.1.2-150100.3.3.3
python3-opencensus-ext-threading - update to 0.1.2-150100.3.3.3
python3-grpcio-gcp - update to 0.2.2-150100.3.3.3
python3-aiocontextvars - update to 0.2.2-150100.3.3.3
python2-grpcio-gcp - update to 0.2.2-150100.3.3.3
python3-Automat - update to 0.6.0-150000.3.4.1
python3-pytest-asyncio - update to 0.8.0-150100.3.3.3
python3-opencensus - update to 0.8.0-150100.3.3.3
python3-knack - update to 0.9.0-150100.3.7.3
perl-Alien-ProtoBuf - update to 0.09-17.fc36
python3-Deprecated - update to 1.2.13-150100.3.3.3
python3-jsondiff - update to 1.3.0-150100.3.6.3
python2-jsondiff - update to 1.3.0-150100.3.6.3
python3-websocket-client - update to 1.3.2-150100.6.7.3
python3-opentelemetry-api - update to 1.5.0-150100.3.3.3
python3-googleapis-common-protos - update to 1.6.0-150100.3.3.3
python2-googleapis-common-protos - update to 1.6.0-150100.3.3.3
python3-avro - update to 1.11.0-150100.3.3.3
python3-google-api-core - update to 1.14.2-150100.3.3.3
grpc-debugsource - update to 1.25.0-150100.3.3.3
grpc-source - update to 1.25.0-150100.3.3.3
grpc-debuginfo - update to 1.25.0-150100.3.3.3
libgrpc++1-debuginfo - update to 1.25.0-150100.3.3.3
python3-grpcio-debuginfo - update to 1.25.0-150100.3.3.3
grpc-devel-debuginfo - update to 1.25.0-150100.3.3.3
python2-grpcio-debuginfo - update to 1.25.0-150100.3.3.3
python2-grpcio - update to 1.25.0-150100.3.3.3
grpc-devel - update to 1.25.0-150100.3.3.3
python3-grpcio - update to 1.25.0-150100.3.3.3
libgrpc8 - update to 1.25.0-150100.3.3.3
libgrpc++1 - update to 1.25.0-150100.3.3.3
libgrpc8-debuginfo - update to 1.25.0-150100.3.3.3
python3-PyGithub - update to 1.43.5-150100.3.3.3
IBM QRadar DNS Analyzer App - update to 2.0.3
Spectrum Discover - addressed in versions 2.0.4.8, 2.1.1
azure-cli-core - update to 2.17.1-150100.6.18.1
python2-requests - update to 2.25.1-150100.6.13.3
python3-requests - update to 2.25.1-150100.6.13.3
libprotoc10 (Ubuntu package) - update to 3.0.0-9.1ubuntu1.1
libprotobuf10 (Ubuntu package) - update to 3.0.0-9.1ubuntu1.1
libprotobuf-lite10 (Ubuntu package) - update to 3.0.0-9.1ubuntu1.1
python3-protobuf (Ubuntu package) - addressed in versions 3.0.0-9.1ubuntu1.1, 3.6.1.3-2ubuntu5.2, 3.12.4-1ubuntu7.22.04.1, 3.12.4-1ubuntu7.22.10.1
python3-cryptography-vectors - update to 3.3.2-150100.3.11.3
python2-cryptography-vectors - update to 3.3.2-150100.3.11.3
python2-cryptography - update to 3.3.2-150100.7.15.3
python3-cryptography - update to 3.3.2-150100.7.15.3
python-cryptography-debugsource - update to 3.3.2-150100.7.15.3
python3-cryptography-debuginfo - update to 3.3.2-150100.7.15.3
python2-cryptography-debuginfo - update to 3.3.2-150100.7.15.3
python-cryptography-debuginfo - update to 3.3.2-150100.7.15.3
PowerStore T - update to 3.5.0.1-2083289
IBM Cloud Pak for Watson AIOps - update to 3.6.1
libprotoc17 (Ubuntu package) - update to 3.6.1.3-2ubuntu5.2
libprotobuf-lite17 (Ubuntu package) - update to 3.6.1.3-2ubuntu5.2
libprotoc-dev (Ubuntu package) - update to 3.6.1.3-2ubuntu5.2
libprotoc20 - addressed in versions 3.9.2-150100.8.3.3, 3.9.2-150200.4.19.2
libprotoc20-debuginfo - addressed in versions 3.9.2-150100.8.3.3, 3.9.2-150200.4.19.2
protobuf-java - addressed in versions 3.9.2-150100.8.3.3, 3.9.2-150200.4.19.2
protobuf-debugsource - addressed in versions 3.9.2-150100.8.3.3, 3.9.2-150200.4.19.2
libprotobuf20-debuginfo - addressed in versions 3.9.2-150100.8.3.3, 3.9.2-150200.4.19.2
protobuf-devel-debuginfo - addressed in versions 3.9.2-150100.8.3.3, 3.9.2-150200.4.19.2
protobuf-devel - addressed in versions 3.9.2-150100.8.3.3, 3.9.2-150200.4.19.2
libprotobuf-lite20-debuginfo - addressed in versions 3.9.2-150100.8.3.3, 3.9.2-150200.4.19.2
python2-protobuf - addressed in versions 3.9.2-150100.8.3.3, 3.9.2-150200.4.19.2
libprotoc20-32bit - addressed in versions 3.9.2-150100.8.3.3, 3.9.2-150200.4.19.2
protobuf-source - addressed in versions 3.9.2-150100.8.3.3, 3.9.2-150200.4.19.2
libprotobuf-lite20 - addressed in versions 3.9.2-150100.8.3.3, 3.9.2-150200.4.19.2
libprotobuf-lite20-32bit - addressed in versions 3.9.2-150100.8.3.3, 3.9.2-150200.4.19.2
libprotobuf20-32bit - addressed in versions 3.9.2-150100.8.3.3, 3.9.2-150200.4.19.2
libprotobuf20 - addressed in versions 3.9.2-150100.8.3.3, 3.9.2-150200.4.19.2
python3-protobuf - addressed in versions 3.9.2-150100.8.3.3, 3.9.2-150200.4.19.2
libprotobuf-lite20-32bit-debuginfo - update to 3.9.2-150200.4.19.2
libprotobuf20-32bit-debuginfo - update to 3.9.2-150200.4.19.2
libprotoc20-32bit-debuginfo - update to 3.9.2-150200.4.19.2
python3-pytest - update to 3.10.1-150000.7.5.1
libprotobuf-java (Ubuntu package) - addressed in versions 3.12.4-1ubuntu7.22.04.1, 3.12.4-1ubuntu7.22.10.1
libprotobuf23 (Ubuntu package) - addressed in versions 3.12.4-1ubuntu7.22.04.1, 3.12.4-1ubuntu7.22.10.1
libprotoc23 (Ubuntu package) - addressed in versions 3.12.4-1ubuntu7.22.04.1, 3.12.4-1ubuntu7.22.10.1
libprotobuf-lite23 (Ubuntu package) - addressed in versions 3.12.4-1ubuntu7.22.04.1, 3.12.4-1ubuntu7.22.10.1
protobuf-lite - addressed in versions 3.14.0-5, 3.14.0-6
protobuf-javadoc - addressed in versions 3.14.0-5, 3.14.0-6
protobuf-devel - addressed in versions 3.14.0-5, 3.14.0-6
protobuf-debuginfo - addressed in versions 3.14.0-5, 3.14.0-6
protobuf - addressed in versions 3.14.0-5, 3.14.0-6
protobuf-lite-devel - addressed in versions 3.14.0-5, 3.14.0-6
protobuf-parent - addressed in versions 3.14.0-5, 3.14.0-6
python3-protobuf - addressed in versions 3.14.0-5, 3.14.0-6
protobuf-bom - addressed in versions 3.14.0-5, 3.14.0-6
protobuf-javalite - addressed in versions 3.14.0-5, 3.14.0-6
protobuf-java - addressed in versions 3.14.0-5, 3.14.0-6
protobuf-java-util - addressed in versions 3.14.0-5, 3.14.0-6
protobuf-compiler - addressed in versions 3.14.0-5, 3.14.0-6
protobuf-debugsource - addressed in versions 3.14.0-5, 3.14.0-6
dev-python/protobuf-python - update to 3.19.6
protobuf - update to 3.19.6-1
protobuf - addressed in versions 3.19.6-1.fc36, 3.19.6-1.fc37
dev-libs/protobuf - update to 3.20.3
Dell EMC PowerStore Family Operating System - update to 4.0.0.0-2284811
python3-zope.interface-debuginfo - update to 4.4.2-150000.3.4.1
python-zope.interface-debuginfo - update to 4.4.2-150000.3.4.1
python-zope.interface-debugsource - update to 4.4.2-150000.3.4.1
python3-zope.interface - update to 4.4.2-150000.3.4.1
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 4.6.2
IBM Watson Discovery for IBM Cloud Pak for Data - update to 4.6.2
python3-psutil-debuginfo - update to 5.9.1-150100.6.6.3
python-psutil-debuginfo - update to 5.9.1-150100.6.6.3
python3-psutil - update to 5.9.1-150100.6.6.3
python2-psutil-debuginfo - update to 5.9.1-150100.6.6.3
python2-psutil - update to 5.9.1-150100.6.6.3
python-psutil-debugsource - update to 5.9.1-150100.6.6.3
Dell EMC VxRail Appliance - update to 7.0.411
Red Hat Ceph Storage - update to 8.1
python3-websockets-debuginfo - update to 9.1-150100.3.3.3
python-websockets-debugsource - update to 9.1-150100.3.3.3
python3-websockets - update to 9.1-150100.3.3.3
python2-humanfriendly - update to 10.0-150100.6.3.3
python3-humanfriendly - update to 10.0-150100.6.3.3
IBM App Connect Enterprise - addressed in versions 11.0.0.21, 11.0.0.23, 12.0.10.0
python3-constantly - update to 15.1.0-150000.3.4.1
python3-hyperlink - update to 17.2.1-150000.3.4.1
python3-incremental - update to 17.5.0-150000.3.4.1
python3-Twisted-debuginfo - update to 17.9.0-150000.3.8.1
python3-Twisted - update to 17.9.0-150000.3.8.1
Robotic Process Automation for Cloud Pak - update to 21.0.7
Automation Assets in IBM Cloud Pak for Integration (CP4I) - update to 2022.2.1-5

External References

Related Security Bulletins