PT-2023-22193 · Vitess · Vitess

Adamkorcz · Published 2023-04-11 · Updated 2023-04-25 · CVE-2023-29194

Positive Technologies (AI Summary)

CVSS v3.1

4.1

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Vitess versions prior to 16.0.1

Description The issue arises when a keyspace containing / characters is created, intentionally or inadvertently, causing errors when attempting to view keyspaces from VTAdmin or when using vtctldclient GetKeyspaces. Other keyspaces can still be administered using the CLI.

Recommendations For versions prior to 16.0.1, update to version 16.0.1 to resolve the issue. As a temporary workaround, delete the offending keyspace using a CLI client, such as vtctldclient --server ... DeleteKeyspace a/b.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

CWE-703

Related Identifiers

AZL-26295

CVE-2023-29194

GHSA-735R-HV67-G38F

GO-2023-1717

Affected Products

Vitess

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/29xxx/CVE-2023-29194.json · Exploit
• https://github.com/vitessio/vitess/commit/adf10196760ad0b3991a7aa7a8580a544e6ddf88 · Patch
• https://github.com/vitessio/vitess/security/advisories/GHSA-735r-hv67-g38f · Vendor Advisory
• https://osv.dev/vulnerability/AZL-26295 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-735r-hv67-g38f · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-29194 · Security Note
• https://osv.dev/vulnerability/GO-2023-1717 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-29194 · Vendor Advisory
• https://github.com/vitessio/vitess · Note
• https://github.com/vitessio/vitess/commits/v0.16.1 · Note
• https://t.me/cibsecurity/62180 · Telegram Post
• https://t.me/cvenotify/49030 · Telegram Post