GHSA-7fxj-fr3v-r9gj
TiDB vulnerable to Use of Externally-Controlled Format String
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | github.com/pingcap/tidb | <= 6.1.2 | no fix listed |
| Go | github.com/pingcap/tidb | >= 6.2.0, <= 6.4.0-alpha1 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
TiDB server (importer CLI tool) prior to version 6.4.0 & 6.1.3 is vulnerable to data source name injection. The database name for generating and inserting data into a database does not properly sanitize user input which can lead to arbitrary file reads."
References
External links from the advisory. They lead to third-party sites.