~ / search / GHSA-wmxm-6wxc-3xqf

GHSA-wmxm-6wxc-3xqf

Apache ShardingSphere-Proxy Incomplete Cleanup vulnerability

Source: GitHub Advisory Database (reviewed) Critical CVE-2022-45347

Packages

EcosystemPackageAffectedFixed in
Maven org.apache.shardingsphere:shardingsphere-proxy < 5.3.0 5.3.0

Details

As written in the advisory (Markdown source, shown as plain text).

Apache ShardingSphere-Proxy prior to 5.3.0 when using MySQL as database backend didn't cleanup the database session completely after client authentication failed, which allowed an attacker to execute normal commands by constructing a special MySQL client. This vulnerability has been fixed in Apache ShardingSphere 5.3.0.

References

External links from the advisory. They lead to third-party sites.