MariaDB Connector/Node.js Security Advisory: SQL Injection, Memory Exhaustion (CONJ5-358/368/369)

Vulnerability Overview Vulnerability ID: CONJ5-358, CONJ5-363, CONJ5-367, CONJ5-368, CONJ5-369 Vulnerability Description: - CONJ5-358: Rejects reassembly of multipart packets (> 16MB) to prevent client memory exhaustion before authentication is completed. - CONJ5-363: Type casting accessor returns corrupted values with prepared statements. - CONJ5-367: Uninitialized process memory leaks to the server via malformed GeoJSON Polygon parameters. - CONJ5-368: Fixes SQL injection vulnerability in the text protocol when the session uses . - CONJ5-369: Fixes SQL injection vulnerability in the SET extension via object keys when is used. Impact Scope Affected Version: MariaDB Connector/Node.js 3.4.7 Specific Impact: - CONJ5-358: May lead to client memory exhaustion. - CONJ5-363: May lead to data corruption. - CONJ5-367: May lead to memory leaks. - CONJ5-368: May lead to SQL injection attacks. - CONJ5-369: May lead to SQL injection attacks. Remediation Fixed Version: MariaDB Connector/Node.js 3.4.7 Remediation Measures: - CONJ5-358: Rejects reassembly of multipart packets (> 16MB) to prevent client memory exhaustion before authentication is completed. - CONJ5-363: Fixes the issue where type casting accessor returns corrupted values with prepared statements. - CONJ5-367: Fixes the issue where uninitialized process memory leaks to the server. - CONJ5-368: Fixes the SQL injection vulnerability in the text protocol when the session uses . - CONJ5-369: Fixes the SQL injection vulnerability in the SET extension via object keys when is used. Code Block No specific POC code or exploit code is included on the page.

Goal Reached Thanks to every supporter — we hit 100%!

MariaDB Connector/Node.js Security Advisory: SQL Injection, Memory Exhaustion (CONJ5-358/368/369)

More from this source