MariaDB CVE-2025-59854 Cleartext Password Transmission Vulnerability

MariaDB Cleartext Transmission of Sensitive Information Vulnerability Summary Vulnerability Overview Vulnerability Name: Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials in MariaDB CVE ID: CVE-2025-59854 Severity: Moderate (CVSS 3.1 Score 5.9/10) Attack Vector: Network Description: When PAM (dialog) authentication is used, the connector may transmit account passwords in cleartext over insecure connections. A malicious or man-in-the-middle server can trigger this issue with default configurations, exposing user passwords. Affected Scope Affected Versions: - = 3.2.0, = 3.4.0, = 3.5.0, < 3.5.3 Fixed Versions: 3.2.4, 3.3.3, 3.4.6, 3.5.3 Impact: Passwords for authenticated accounts are exposed in cleartext to on-path or malicious servers; captured credentials can be replayed to authenticate to the database. Remediation Patch: Fixed in 3.2.4, 3.3.3, 3.4.6, and 3.5.3. Upgrade to the fixed version for the corresponding branch: - 3.5.x → 3.5.3 - 3.4.x → 3.4.6 - 3.3.x → 3.3.3 - Older versions → 3.2.4 How It Works: After the fix, the plugin only operates over secure connections; overrides the secure transport flag to true, and the authentication scheduler allows plugins that rely solely on self-signed certificate fingerprint verification. Temporary Mitigations Restrict the allowed authentication plugins: Change from dialog to allow only TLS or Unix socket connections. Avoid using PAM (dialog) authentication over cleartext TCP. References CONUS-353: https://lna.mariadb.org/browse/CONUS-353 Reporter: Yalçın Tumenkaya (@tygnd)

Goal Reached Thanks to every supporter — we hit 100%!

MariaDB CVE-2025-59854 Cleartext Password Transmission Vulnerability

More from this source