Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.
First Last Prev Next    This bug is not in your last search results.
Bug 1444759 - (CVE-2017-3523) CVE-2017-3523 mysql-connector-java: Improper automatic deserialization of binary data (CPU Apr 2017)
CVE-2017-3523 mysql-connector-java: Improper automatic deserialization of bin...
Status: NEW
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
high Severity high
: ---
: ---
Assigned To: Red Hat Product Security
impact=important,public=20170421,repo...
: Security
Depends On: 1444418 1464466 1464467
Blocks: 1444415
  Show dependency tree / graph
 
Reported: 2017-04-24 04:29 EDT by Andrej Nemec
Modified: 2018-06-29 18:20 EDT (History)
29 users (show)

See Also:
Fixed In Version: mysql-connector-java 5.1.41
Doc Type: If docs needed, set a value
Doc Text:
It was discovered that the MySQL Connector/J client could deserialize certain database contents, regardless of the "autoDeserialize" option. If the client processes data received from an untrusted or compromised database server, a remote attacker could exploit this flaw to cause remote code execution.
Story Points: ---
Clone Of:
Environment:
Last Closed:
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

  None (edit)
Description Andrej Nemec 2017-04-24 04:29:56 EDT 
Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/J). Supported versions that are affected are 5.1.40 and eariler. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. While the vulnerability is in MySQL Connectors, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of MySQL Connectors.

http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html#AppendixMSQL
Comment 1 Andrej Nemec 2017-04-24 04:31:44 EDT 
Created mysql-connector-java tracking bugs for this issue:

Affects: fedora-all [bug 1444418]
Comment 2 Tomas Hoger 2017-05-03 07:07:30 EDT 
Further details are now available via an advisory from the original issue reporter:

https://www.computest.nl/advisories/CT-2017-0425_MySQL-Connector-J.txt

The advisory describes that the MySQL Connector/J can perform Java object deserialization even when autoDeserialize flag is set to false.  In certain cases, a malicious MySQL server could use this flaw to execute arbitrary code on the client using the Connector/J.

Upstream commit:

https://github.com/mysql/mysql-connector-j/commit/6189e718de5b6c6115aee45dd7a480081c129d68

There does not seem to be any mention of the issue in the 5.1.41 release notes:

https://dev.mysql.com/doc/relnotes/connector-j/5.1/en/news-5-1-41.html
Comment 7 Jason Shepherd 2017-09-17 21:15:26 EDT 
RHMAP mysql-connector upgrades are done, will do a patch release on 4.5.0
Comment 11 Stefan Cornelius 2018-02-22 04:52:30 EST 
Statement:

This issue affects the versions of mysql-connector-java as shipped with Red Hat Enterprise Linux 6 and 7.
Note You need to log in before you can comment on or make changes to this bug.
First Last Prev Next    This bug is not in your last search results.