MariaDB Connector/Node.js Multiple Vulnerabilities Summary (SQLi/Memory Leak)

MariaDB Connector/Node.js 3.3.4 Vulnerability Summary Vulnerability Overview CONJ5-358: Rejects reassembly of multi-part packets (> 16MB) until authentication is complete. Otherwise, a malicious server can exhaust client memory before any credentials are verified. CONJ5-363: The accessor returns corrupted values when used with prepared statements. CONJ5-367: Uninitialized process memory is leaked to the server via malformed GeoJSON Polygon parameters (reported by fg0x0). CONJ5-368: Fixes SQL injection issues in the text protocol when the session mode is enabled (reported by fg0x0). CONJ5-369: Fixes SQL injection issues in the SET extension via object keys when is enabled (reported by fg0x0). CONJ5-370: Escapes filenames provided by the server before constructing the validation regular expression. Impact Scope CONJ5-358: May lead to client-side memory exhaustion, affecting client stability. CONJ5-363: May lead to data corruption, affecting data integrity. CONJ5-367: May lead to sensitive information leakage, affecting data security. CONJ5-368: May lead to SQL injection attacks, affecting database security. CONJ5-369: May lead to SQL injection attacks, affecting database security. CONJ5-370: May lead to file reading vulnerabilities, affecting data security. Remediation CONJ5-358: Rejects reassembly of multi-part packets (> 16MB) before authentication is complete. CONJ5-363: Fixes the accessor to ensure it returns correct values. CONJ5-367: Fixes the uninitialized process memory leak issue. CONJ5-368: Fixes SQL injection issues when the session mode is enabled. CONJ5-369: Fixes SQL injection issues when is enabled. CONJ5-370: Escapes filenames provided by the server before constructing the validation regular expression. Code Blocks No specific POC code or exploit code is included in the page.

Goal Reached Thanks to every supporter — we hit 100%!

MariaDB Connector/Node.js Multiple Vulnerabilities Summary (SQLi/Memory Leak)

More from this source