MySQL Connector/J Vulnerability - Unauthorized Access and Denial of Service Risk
Summary
UBUNTU-CVE-2020-2934: Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Affects mysql-connector-java versions 5.1.25-1 – 5.1.28-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
MySQL Connector/J is a JDBC driver that enables Java applications to interact with MySQL databases. It is widely used for connecting Java applications to MySQL, providing essential functionalities such as data retrieval and manipulation. The driver is crucial for applications that rely on MySQL for data storage and management. However, certain versions of this package are vulnerable to a security flaw that can lead to unauthorized access and potential denial of service.
Vulnerability Detail
The vulnerability, identified as CVE-2020-2934, affects MySQL Connector/J versions 8.0.19 and prior, as well as 5.1.48 and prior. It allows unauthenticated attackers with network access to exploit the connector through various protocols. Successful exploitation requires human interaction from a user other than the attacker. The consequences of this vulnerability include unauthorized updates, inserts, or deletions of data, unauthorized read access to sensitive data, and the potential to cause a partial denial of service (DoS) to the MySQL Connectors. The CVSS score for this vulnerability is 5.0, indicating moderate severity with impacts on confidentiality, integrity, and availability.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider restricting network access to the MySQL Connector/J to trusted sources only. This can help mitigate the risk of unauthorized access while you work on updating to a secure version.
Conclusion
The vulnerability CVE-2020-2934 poses a significant risk to users of MySQL Connector/J, allowing unauthorized access and potential denial of service. It is crucial to update to a secure version to mitigate these risks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for mysql-connector-java →
FAQ
CVE-2020-2934 is a vulnerability in MySQL Connector/J that allows unauthorized access and potential denial of service.
Affected versions include 8.0.19 and prior, as well as 5.1.48 and prior.
The vulnerability can lead to unauthorized data access, modification, and partial denial of service.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without any signup.
If immediate updates are not possible, restrict network access to trusted sources as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for mysql-connector-java.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
