PT-2019-20006 · Mysql Server+1 · Mysql Server+1

Publicado 2019-05-23 · Atualizado 2019-05-23

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions mysql versions prior to 2.14.0

Description The issue concerns the exposure of uninitialized memory over the network when a number is used as a password in affected mysql package versions. This occurs because the package allocates and sends uninitialized memory when such a password is provided. The vulnerability specifically affects mysql running on Node.js versions below 6.0.0, due to changes in newer Node.js versions.

Recommendations Update to version 2.14.0 or later.

Enumeração de Fraquezas

CWE-201

Identificadores relacionados

GHSA-5F7M-MMPC-QHH4

Produtos afetados

Node.Js

Mysql Server

Referências · 5

• https://github.com/mysqljs/mysql/commit/192fe45593ba5768534afb6f2154432ca67a5002 · Nota
• https://github.com/mysqljs/mysql/commit/310c6a7d1b2e14b63b572dbfbfa10128f20c6d52 · Nota
• https://github.com/mysqljs/mysql · Nota
• https://npmjs.com/advisories/602 · Nota
• https://osv.dev/vulnerability/GHSA-5f7m-mmpc-qhh4 · Aviso do Fabricante