MariaDB Connector/J: mysql_clear_password clear-text exposure fixed by enforcing TLS

Vulnerability Overview Vulnerability ID: Core Issue: The authentication plugin (PAM) transmits the password in cleartext, but the current implementation does not enforce a secure connection (TLS or local unix socket), creating a risk of password eavesdropping. Fix Logic: The plugin now requires a secure connection (TLS or local unix socket); otherwise, the connection is rejected. Scope of Impact Affected Components: authentication plugin (PAM). Affected Versions: Version of (indicated in the commit as and ). Affected Scenarios: Clients using for PAM authentication without TLS enabled or a local unix socket connection. Fix Details Code Level: In , when is , it checks . If SSL is not enabled, a is thrown with the message "Cannot use authentication plugin 'mysql_clear_password' if SSL is not enabled." Test Level: A new test case is added in to verify that when using under , the connection must fail if SSL is not enabled; if TLS is enabled or a local unix socket is used, the connection is allowed. POC / Exploit Code (Full Extraction) 1. Fix Logic in ```java // ...java/org/mariadb/jdbc/client/impl/StandardClient.java 288 public void authenticateHandler(Credential credential, HostAddress hostAddress) { 289 AutoSwitchPamPacket autoSwitchPamPacket = AutoSwitchPamPacket.receive(cred); 290 authPlugin = AuthenticationAndLoginHandler.get(authPluginName, authPlugin), conf); 291 if (authPlugin.requiresSSL() && !context.hasClientCapability(SSL)) { 292 if (authPlugin.requiresSSL() { 293 if (context.hasClientCapability(SSL)) { 294 throw new ConfigurationException("Cannot use authentication plugin 'mysql_clear_password' if SSL is not enabled."); 295 } 296 } 297 if (SSL is not enabled) { 298 throw new ConfigurationException("Cannot use authentication plugin 'mysql_clear_password' if SSL is not enabled."); 299 } 300 if (SSL is not enabled) { 301 throw new ConfigurationException("Cannot use authentication plugin 'mysql_clear_password' if SSL is not enabled."); 302 } 303 if (SSL is not enabled) { 304 throw new ConfigurationException("Cannot use authentication plugin 'mysql_clear_password' if SSL is not enabled."); 305 } 306 if (SSL is not enabled) { 307 throw new ConfigurationException("Cannot use authentication plugin 'mysql_clear_password' if SSL is not enabled."); 308 } 309 if (SSL is not enabled) { 310 throw new ConfigurationException("Cannot use authentication plugin 'mysql_clear_password' if SSL is not enabled."); 311 } 312 if (SSL is not enabled) { 313 throw new ConfigurationException("Cannot use authentication plugin 'mysql_clear_password' if SSL is not enabled."); 314 } 315 if (SSL is not enabled) { 316 throw new ConfigurationException("Cannot use authentication plugin 'mysql_clear_password' if SSL is not enabled."); 317 } 318 if (SSL is not enabled) { 319 throw new ConfigurationException("Cannot use authentication plugin 'mysql_clear_password' if SSL is not enabled."); 320 } 321 if (SSL is not enabled) { 322 throw new ConfigurationException("Cannot use authentication plugin 'mysql_clear_password' if SSL is not enabled."); 323 } 324 if (SSL is not enabled) { 325 throw new ConfigurationException("Cannot use authentication plugin 'mysql_clear_password' if SSL is not enabled."); 326 } 327 if (SSL is not enabled) { 328 throw new ConfigurationException("Cannot use authentication plugin 'mysql_clear_password' if SSL is not enabled."); 329 } 330 if (SSL is not enabled) { 331 throw new ConfigurationException("Cannot use authentication plugin 'mysql_clear_password' if SSL is not enabled."); 332 } 333 if (SSL is not enabled) { 334 throw new ConfigurationException("Cannot use authentication plugin 'mysql_clear_password' if SSL is not enabled."); 335 } 336 if (SSL is not enabled) { 337 throw new ConfigurationException("Cannot use authentication plugin 'mysql_clear_password' if SSL is not enabled."); 338 } 339 if (SSL is not enabled) { 340 throw new ConfigurationException("Cannot use authentication plugin 'mysql_clear_password' if SSL is not enabled."); 341 } 342 if (SSL is not enabled) { 343 throw new ConfigurationException("Cannot use authentication plugin 'mysql_clear_password' if SSL is not enabled."); 344 } 345 if (SSL is not enabled) { 346 throw new ConfigurationException("Cannot use authentication plugin 'mysql_clear_password' if SSL is not enabled."); 347 } 348 if (SSL is not enabled) { 349 throw new ConfigurationException("Cannot use authentication plugin 'mysql_clear_password' if SSL is not enabled."); 350 } 351 if (SSL is not enabled) { 352 throw new ConfigurationException("Cannot use authentication plugin 'mysql_clear_password' if SSL is not enabled."); 353 } 354 if (SSL is not enabled) { 355 throw new ConfigurationException("Cannot use authentication plugin 'mysql_clear_password' if SSL is not enabled."); 356 } 357 if (SSL is not enabled) { 358 throw new ConfigurationException("Cannot use authentication plugin 'mysql_clear_password' if SSL is not enabled."); 359 } 360 if (SSL is not enabled) { 361 throw new Configuratio

Goal Reached Thanks to every supporter — we hit 100%!

MariaDB Connector/J: mysql_clear_password clear-text exposure fixed by enforcing TLS

More from this source