PT-2019-20006 · Mysql Server+1 · Mysql Server+1

Published 2019-05-23 · Updated 2019-05-23

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions mysql versions prior to 2.14.0

Description The issue concerns the exposure of uninitialized memory over the network when a number is used as a password in affected mysql package versions. This occurs because the package allocates and sends uninitialized memory when such a password is provided. The vulnerability specifically affects mysql running on Node.js versions below 6.0.0, due to changes in newer Node.js versions.

Recommendations Update to version 2.14.0 or later.

Weakness Enumeration

CWE-201

Related Identifiers

GHSA-5F7M-MMPC-QHH4

Affected Products

Node.Js

Mysql Server

References · 5

• https://osv.dev/vulnerability/GHSA-5f7m-mmpc-qhh4 · Vendor Advisory
• https://github.com/mysqljs/mysql/commit/192fe45593ba5768534afb6f2154432ca67a5002 · Note
• https://github.com/mysqljs/mysql/commit/310c6a7d1b2e14b63b572dbfbfa10128f20c6d52 · Note
• https://github.com/mysqljs/mysql · Note
• https://npmjs.com/advisories/602 · Note