Every CVE Search/ Get API key

CVE-2019-2435

Improper Access Control in MySQL Connector Python

8.1 HighFix available

CVE-2019-2435 is a high vulnerability (CVSS 8.1) in Oracle Mysql Connectors, published January 16, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.53%, the 84th percentile. Fixed in mysql-connector-python 8.0.19.

Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/Python). Supported versions that are affected are 8.0.13 and prior and 2.1.8 and prior. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise MySQL Connectors. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all MySQL Connectors accessible data as well as unauthorized access to critical data or complete access to all MySQL Connectors accessible data. CVSS 3.0 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N).

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
None

Exploit likelihood

2.53%Up 1.3 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 8.1

Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/Python). Supported versions that are affected are 8.0.13 and prior and 2.1.8 and prior. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise MySQL Connectors. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all MySQL Connectors accessible data as well as unauthorized access to critical data or complete access to all MySQL Connectors accessible data. CVSS 3.0 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N).

Record
CVE-2019-2435
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
CVSS 2.0
5.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:N
Updated
2026-11-02
CVE List No score

Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/Python). Supported versions that are affected are 8.0.13 and prior and 2.1.8 and prior. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise MySQL Connectors. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all MySQL Connectors accessible data as well as unauthorized access to critical data or complete access to all MySQL Connectors accessible data. CVSS 3.0 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N).

Record
CVE-2019-2435
Updated
2026-11-02
EUVDEUVD-2022-5289 No score

Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/Python). Supported versions that are affected are 8.0.13 and prior and 2.1.8 and prior. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise MySQL Connectors. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all MySQL Connectors accessible data as well as unauthorized access to critical data or complete access to all MySQL Connectors accessible data. CVSS 3.0 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N).

Record
EUVD-2022-5289
Updated
2026-11-03
GitHub AdvisoriesGHSA-v5rq-w2xm-7g5f 8.1

Improper Access Control in MySQL Connector Python

Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/Python). Supported versions that are affected are 8.0.13 and prior and 2.1.8 and prior. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise MySQL Connectors. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all MySQL Connectors accessible data as well as unauthorized access to critical data or complete access to all MySQL Connectors accessible data.

Record
GHSA-v5rq-w2xm-7g5f
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Weakness
CWE-284
Updated
2026-11-02
OSVGHSA-v5rq-w2xm-7g5f 8.1

Improper Access Control in MySQL Connector Python

Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/Python). Supported versions that are affected are 8.0.13 and prior and 2.1.8 and prior. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise MySQL Connectors. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all MySQL Connectors accessible data as well as unauthorized access to critical data or complete access to all MySQL Connectors accessible data.

Record
GHSA-v5rq-w2xm-7g5f
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Weakness
CWE-284
Updated
2026-11-02
OSVPYSEC-2026-683 8.1

Improper Access Control in MySQL Connector Python

Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/Python). Supported versions that are affected are 8.0.13 and prior and 2.1.8 and prior. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise MySQL Connectors. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all MySQL Connectors accessible data as well as unauthorized access to critical data or complete access to all MySQL Connectors accessible data.

Record
PYSEC-2026-683
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
Show 7 moreShow less
OSVUBUNTU-CVE-2019-2435 8.1

Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/Python). Supported versions that are affected are 8.0.13 and prior and 2.1.8 and prior. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise MySQL Connectors. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all MySQL Connectors accessible data as well as unauthorized access to critical data or complete access to all MySQL Connectors accessible data. CVSS 3.0 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N).

Record
UBUNTU-CVE-2019-2435
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVMGASA-2020-0345 No score

Updated mysql-connector-python packages fix security vulnerability

Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise MySQL Connectors. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all MySQL Connectors accessible data as well as unauthorized access to critical data or complete access to all MySQL Connectors accessible data (CVE-2019-2435).

Also, the protobuf package was updated to add a python3 subpackage, which was needed for this update.

Record
MGASA-2020-0345
Updated
2026-11-02
OSVopenSUSE-SU-2020:0409-1 No score

Security update for python-mysql-connector-python

This update for python-mysql-connector-python fixes the following issues:

python-mysql-connector-python was updated to 8.0.19 (boo#1122204 - CVE-2019-2435):

  • WL#13531: Remove xplugin namespace
  • WL#13372: DNS SRV support
  • WL#12738: Specify TLS ciphers to be used by a client or session
  • BUG#30270760: Fix reserved filed should have a length of 22
  • BUG#29417117: Close file in handle load data infile
  • WL#13330: Single C/Python (Win) MSI installer
  • WL#13335: Connectors should handle expired password sandbox without SET operations
  • WL#13194: Add support for Python 3.8
  • BUG#29909157: Table scans of floats causes memory leak with the C extension
  • BUG#25349794: Add read_default_file alias for option_files in connect()
  • WL#13155: Support new utf8mb4 bin collation
  • WL#12737: Add overlaps and not_overlaps as operator
  • WL#12735: Add README.rst and CONTRIBUTING.rst files
  • WL#12227: Indexing array fields
  • WL#12085: Support cursor prepared statements with C extension
  • BUG#29855733: Fix error during connection using charset and collation combination
  • BUG#29833590: Calling execute() should fetch active results
  • BUG#21072758: Support for connection attributes classic
  • WL#12864: Upgrade of Protobuf version to 3.6.1
  • WL#12863: Drop support for Django versions older than 1.11
  • WL#12489: Support new session reset functionality
  • WL#12488: Support for session-connect-attributes
  • WL#12297: Expose metadata about the source and binaries
  • WL#12225: Prepared statement support
  • BUG#29324966: Add missing username connection argument for driver compatibility
  • BUG#29278489: Fix wrong user and group for Solaris packages
  • BUG#29001628: Fix access by column label in Table.select()
  • BUG#28479054: Fix Python interpreter crash due to memory corruption
  • BUG#27897881: Empty LONG BLOB throws an IndexError
  • BUG#29260128: Disable load data local infile by default
  • WL#12607: Handling of Default Schema
  • WL#12493: Standardize count method
  • WL#12492: Be prepared for initial notice on connection
  • BUG#28646344: Remove expression parsing on values
  • BUG#28280321: Fix segmentation fault when using unicode characters in tables
  • BUG#27794178: Using use_pure=False should raise an error if cext is not available
  • BUG#27434751: Add a TLS/SSL option to verify server name
  • WL#12239: Add support for Python 3.7
  • WL#12226: Implement connect timeout
  • WL#11897: Implement connection pooling for xprotocol
  • BUG#28278352: C extension mysqlx Collection.add() leaks memory in sequential calls
  • BUG#28037275: Missing bind parameters causes segfault or unclear error message
  • BUG#27528819: Support special characters in the user and password using URI
  • WL#11951: Consolidate discrepancies between pure and c extension
  • WL#11932: Remove Fabric support
  • WL#11898: Core API v1 alignment
  • BUG#28188883: Use utf8mb4 as the default character set
  • BUG#28133321: Fix incorrect columns names representing aggregate functions
  • BUG#27962293: Fix Django 2.0 and MySQL 8.0 compatibility issues
  • BUG#27567999: Fix wrong docstring in ModifyStatement.patch()
  • BUG#27277937: Fix confusing error message when using an unsupported collation
  • BUG#26834200: Deprecate Row.get_string() method
  • BUG#26660624: Fix missing install option in documentation
  • WL#11668: Add SHA256_MEMORY authentication mechanism
  • WL#11614: Enable C extension by default
  • WL#11448: New document _id generation support
  • WL#11282: Support new locking modes NOWAIT and SKIP LOCKED
  • BUG#27639119: Use a list of dictionaries to store warnings
  • BUG#27634885: Update error codes for MySQL 8.0.11
  • BUG#27589450: Remove upsert functionality from WriteStatement class
  • BUG#27528842: Fix internal queries open for SQL injection
  • BUG#27364914: Cursor prepared statements do not convert strings
  • BUG#24953913: Fix failing unittests
  • BUG#24948205: Results from JSON_TYPE() are returned as bytearray
  • BUG#24948186: JSON type results are bytearray instead of corresponding python type
  • WL#11372: Remove configuration API -…
Record
openSUSE-SU-2020:0409-1
Updated
2026-11-02
OSVopenSUSE-SU-2020:0430-1 No score

Security update for python-mysql-connector-python

This update for python-mysql-connector-python fixes the following issues:

python-mysql-connector-python was updated to 8.0.19 (boo#1122204 - CVE-2019-2435):

  • WL#13531: Remove xplugin namespace
  • WL#13372: DNS SRV support
  • WL#12738: Specify TLS ciphers to be used by a client or session
  • BUG#30270760: Fix reserved filed should have a length of 22
  • BUG#29417117: Close file in handle load data infile
  • WL#13330: Single C/Python (Win) MSI installer
  • WL#13335: Connectors should handle expired password sandbox without SET operations
  • WL#13194: Add support for Python 3.8
  • BUG#29909157: Table scans of floats causes memory leak with the C extension
  • BUG#25349794: Add read_default_file alias for option_files in connect()
  • WL#13155: Support new utf8mb4 bin collation
  • WL#12737: Add overlaps and not_overlaps as operator
  • WL#12735: Add README.rst and CONTRIBUTING.rst files
  • WL#12227: Indexing array fields
  • WL#12085: Support cursor prepared statements with C extension
  • BUG#29855733: Fix error during connection using charset and collation combination
  • BUG#29833590: Calling execute() should fetch active results
  • BUG#21072758: Support for connection attributes classic
  • WL#12864: Upgrade of Protobuf version to 3.6.1
  • WL#12863: Drop support for Django versions older than 1.11
  • WL#12489: Support new session reset functionality
  • WL#12488: Support for session-connect-attributes
  • WL#12297: Expose metadata about the source and binaries
  • WL#12225: Prepared statement support
  • BUG#29324966: Add missing username connection argument for driver compatibility
  • BUG#29278489: Fix wrong user and group for Solaris packages
  • BUG#29001628: Fix access by column label in Table.select()
  • BUG#28479054: Fix Python interpreter crash due to memory corruption
  • BUG#27897881: Empty LONG BLOB throws an IndexError
  • BUG#29260128: Disable load data local infile by default
  • WL#12607: Handling of Default Schema
  • WL#12493: Standardize count method
  • WL#12492: Be prepared for initial notice on connection
  • BUG#28646344: Remove expression parsing on values
  • BUG#28280321: Fix segmentation fault when using unicode characters in tables
  • BUG#27794178: Using use_pure=False should raise an error if cext is not available
  • BUG#27434751: Add a TLS/SSL option to verify server name
  • WL#12239: Add support for Python 3.7
  • WL#12226: Implement connect timeout
  • WL#11897: Implement connection pooling for xprotocol
  • BUG#28278352: C extension mysqlx Collection.add() leaks memory in sequential calls
  • BUG#28037275: Missing bind parameters causes segfault or unclear error message
  • BUG#27528819: Support special characters in the user and password using URI
  • WL#11951: Consolidate discrepancies between pure and c extension
  • WL#11932: Remove Fabric support
  • WL#11898: Core API v1 alignment
  • BUG#28188883: Use utf8mb4 as the default character set
  • BUG#28133321: Fix incorrect columns names representing aggregate functions
  • BUG#27962293: Fix Django 2.0 and MySQL 8.0 compatibility issues
  • BUG#27567999: Fix wrong docstring in ModifyStatement.patch()
  • BUG#27277937: Fix confusing error message when using an unsupported collation
  • BUG#26834200: Deprecate Row.get_string() method
  • BUG#26660624: Fix missing install option in documentation
  • WL#11668: Add SHA256_MEMORY authentication mechanism
  • WL#11614: Enable C extension by default
  • WL#11448: New document _id generation support
  • WL#11282: Support new locking modes NOWAIT and SKIP LOCKED
  • BUG#27639119: Use a list of dictionaries to store warnings
  • BUG#27634885: Update error codes for MySQL 8.0.11
  • BUG#27589450: Remove upsert functionality from WriteStatement class
  • BUG#27528842: Fix internal queries open for SQL injection
  • BUG#27364914: Cursor prepared statements do not convert strings
  • BUG#24953913: Fix failing unittests
  • BUG#24948205: Results from JSON_TYPE() are returned as bytearray
  • BUG#24948186: JSON type results are bytearray instead of corresponding python type
  • WL#11372: Remove configuration API -…
Record
openSUSE-SU-2020:0430-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11240-1 No score

python36-mysql-connector-python-8.0.19-2.9 on GA media

These are all security issues fixed in the python36-mysql-connector-python-8.0.19-2.9 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11240-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:14149-1 No score

python310-mysql-connector-python-8.2.0-1.5 on GA media

These are all security issues fixed in the python310-mysql-connector-python-8.2.0-1.5 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:14149-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:12019-1 No score

python313-mysql-connector-python-9.7.0-1.2 on GA media

These are all security issues fixed in the python313-mysql-connector-python-9.7.0-1.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:12019-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
mysql-connector-python
PyPI
 8.0.0 to 8.0.13
8.0.19
mysql-connector-python
PyPI
 2.1.0 to 2.1.8 None known
mysql-connector-python
PyPI
 8.0.0 up to 8.0.19, plus listed versions
8.0.5
8.0.19
protobuf
Mageia:7
 before 3.6.1-1.1.mga7
3.6.1-1.1.mga7
mysql-connector-python
Mageia:7
 before 8.0.20-1.mga7
8.0.20-1.mga7
mysql-connector-python
PyPI
 2.1.0 up to 8.0.19, plus listed versions
8.0.5
8.0.19
mysql-connector-python
Ubuntu:16.04:LTS
 All versions, plus listed versions
2.0.4-1
 None known
mysql-connector-python
Ubuntu:18.04:LTS
 All versions, plus listed versions
2.1.6-1
 None known
mysql-connector-python
Ubuntu:20.04:LTS
 All versions, plus listed versions
8.0.15-18.0.15-2build1
 None known
mysql-connector-python
Ubuntu:22.04:LTS
 All versions, plus listed versions
8.0.15-2build1
 None known
Show 8 moreShow less
Affected packages
PackageAffectedFixed
mysql-connector-python
Ubuntu:24.04:LTS
 All versions, plus listed versions
8.0.15-38.0.15-4
 None known
mysql-connector-python
Ubuntu:25.10
 All versions, plus listed versions
9.2.0-19.3.0-1
 None known
mysql-connector-python
Ubuntu:26.10
 All versions, plus listed versions
9.5.0-19.7.0-19.7.0-226.7.0-1
 None known
mysql-connector-python
Ubuntu:26.04:LTS
 All versions, plus listed versions
9.3.0-19.5.0-1
 None known
python-mysql-connector-python
openSUSE:Leap 15.1
 before 8.0.19-lp151.3.3.1
8.0.19-lp151.3.3.1
python-mysql-connector-python
SUSE:Package Hub 15 SP1
 before 8.0.19-bp151.4.3.1
8.0.19-bp151.4.3.1
python-mysql-connector-python
openSUSE:Tumbleweed
 before 8.2.0-1.5
8.2.0-1.5
python-mysql-connector-python
openSUSE:Tumbleweed
 before 9.7.0-1.2
9.7.0-1.2

History

History
WhenChangedSources
2026-11-03aliasesEUVD
2026-11-02createdCVE List, GitHub Advisories, NVD, OSV

References

Show 14 moreShow less
This page doesn't list everything

Left out here: the rest of 2 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open