Critical Vulnerability in MySQL Connector/J: Unauthorized Access and Denial of Service Risk
Summary
UBUNTU-CVE-2024-21262: Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/ODBC). Affects mysql-connector-java versions 5.1.25-1 – 5.1.28-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MySQL Connector/J is a JDBC driver for MySQL, enabling Java applications to connect to MySQL databases. It facilitates database operations such as querying and updating data. The affected versions of this package include 5.1.28-1, 5.1.38-1, and 5.1.45-1 across various Ubuntu LTS distributions. This vulnerability exposes the connector to unauthorized access and potential denial of service, impacting the integrity and availability of data.
Vulnerability Detail
A vulnerability exists in the MySQL Connectors product of Oracle MySQL, specifically in the Connector/ODBC component. Supported versions affected are 9.0.0 and prior. The vulnerability is easily exploitable by an unauthenticated attacker with network access via multiple protocols. Successful exploitation can lead to unauthorized updates, inserts, or deletions of data, as well as a partial denial of service (partial DOS) of MySQL Connectors. The CVSS 3.1 Base Score for this vulnerability is 6.5, indicating moderate severity with impacts on integrity and availability.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, consider restricting network access to the MySQL Connectors to trusted IP addresses only, thereby minimizing the risk of unauthorized access until the package can be updated.
Conclusion
The vulnerability in MySQL Connector/J poses significant risks, including unauthorized access and potential denial of service. It is crucial to update to the latest patched version to mitigate these risks. Additionally, implementing network access restrictions can serve as a temporary workaround until the update is applied.
See every vulnerability recorded for mysql-connector-java →
FAQ
The CVSS score of this vulnerability is 6.5, indicating a moderate level of severity.
The affected versions include 5.1.28-1, 5.1.38-1, and 5.1.45-1 across Ubuntu LTS distributions.
Exploitation of this vulnerability can lead to unauthorized data access, modification, and partial denial of service.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Vulert monitors and alerts for open-source vulnerabilities in software using just a manifest file like package-lock.json, allowing for real-time tracking.
References
Related vulnerabilities
Recent vulnerabilities recorded for mysql-connector-java.
