Bug 2256474 (CVE-2023-22102) - CVE-2023-22102 mysql-connector-java: Connector/J unspecified vulnerability (CPU October 2023)
Summary: CVE-2023-22102 mysql-connector-java: Connector/J unspecified vulnerability (C...
Keywords:
Status: NEW
Alias: CVE-2023-22102
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2256475 2256480 2256481
Blocks: 2256484
TreeView+ depends on / blocked
 
Reported: 2024-01-02 14:49 UTC by Mauro Matteo Cascella
Modified: 2024-05-03 18:49 UTC (History)
66 users (show)

Fixed In Version:
Doc Type: ---
Doc Text:
A vulnerability was found in the MySQL Connectors product of Oracle MySQL (component: Connector/J). This issue may allow unauthenticated attackers with network access via multiple protocols to compromise MySQL Connectors. Successful attacks can result in a takeover of MySQL Connectors.
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2024:0722 0 None None None 2024-02-12 15:24:45 UTC

Description Mauro Matteo Cascella 2024-01-02 14:49:34 UTC 
Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.1.0 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in MySQL Connectors, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of MySQL Connectors.

References:
https://www.oracle.com/security-alerts/cpuoct2023.html#AppendixMSQL
https://nvd.nist.gov/vuln/detail/CVE-2023-22102
Comment 1 Mauro Matteo Cascella 2024-01-02 14:49:57 UTC 
Created mysql-connector-java tracking bugs for this issue:

Affects: fedora-all [bug 2256475]
Comment 2 Mauro Matteo Cascella 2024-01-02 14:50:39 UTC 
The package mariadb Java client is available in Red Hat Software Collections. It can be installed this way:

  # yum-config-manager --enable rhel-server-rhscl-7-rpms
  # yum install rh-mariadb105-mariadb-java-client

This JDBC driver works fine with both MariaDB and MySQL servers. We recommend use of mariadb-java-client over mysql-java-connector where possible.
Comment 6 errata-xmlrpc 2024-02-12 15:24:41 UTC 
This issue has been addressed in the following products:

  Red Hat build of Quarkus 3.2.10

Via RHSA-2024:0722 https://access.redhat.com/errata/RHSA-2024:0722
Note You need to log in before you can comment on or make changes to this bug.