MariaDB Connector/Node.js Security Fixes: SQLi, Memory Leak, and DoS

MariaDB Connector/Node.js 3.2.5 Vulnerability Summary Vulnerability Overview CONJ5-358: Rejects reassembly of multipart packets (>16MB) prior to completion of authentication, preventing malicious servers from exhausting client memory, even with valid credentials. CONJ5-363: Fixes type conversion accessors to return correct values when used with prepared statements. CONJ5-367: Prevents un-initialized process memory from leaking to the server via malformed GeoJSON Polygon parameters (reported by fg0x0). CONJ5-368: Resolves an SQL injection vulnerability in the text protocol when the session variable is enabled (reported by fg0x0). CONJ5-369: Resolves an SQL injection vulnerability in the SET extension via object keys when is enabled (reported by fg0x0). CONJ5-370: Escapes filenames provided by the server before constructing the validation regular expression. Impact Scope CONJ5-358: May lead to client-side memory exhaustion, impacting system stability. CONJ5-363: May cause data corruption, affecting data integrity. CONJ5-367: May lead to information leakage, affecting data security. CONJ5-368: May enable SQL injection attacks, affecting database security. CONJ5-369: May enable SQL injection attacks, affecting database security. CONJ5-370: May enable arbitrary file read vulnerabilities, affecting data security. Mitigation CONJ5-358: Rejects reassembly of multipart packets (>16MB) prior to completion of authentication. CONJ5-363: Fixes type conversion accessors to ensure correct values are returned. CONJ5-367: Fixes the issue of uninitialized process memory leakage. CONJ5-368: Fixes the SQL injection issue occurring when is enabled for the session. CONJ5-369: Fixes the SQL injection issue occurring when is enabled. CONJ5-370: Escapes filenames provided by the server before constructing the validation regular expression. Code Block No specific Proof of Concept (PoC) code or exploit code is included in the page.

Goal Reached Thanks to every supporter — we hit 100%!

MariaDB Connector/Node.js Security Fixes: SQLi, Memory Leak, and DoS

More from this source