CVE-2023-21971

Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.0.32 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Connectors as well as unauthorized update, insert or delete access to some of MySQL Connectors accessible data and unauthorized read access to a subset of MySQL Connectors accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:H).

Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.0.32 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Connectors as well as unauthorized update, insert or delete access to some of MySQL Connectors accessible data and unauthorized read access to a subset of MySQL Connectors accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:H).

Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.0.32 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Connectors as well as unauthorized update, insert or delete access to some of MySQL Connectors accessible data and unauthorized read access to a subset of MySQL Connectors accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:H).

Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.0.32 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Connectors as well as unauthorized update, insert or delete access to some of MySQL Connectors accessible data and unauthorized read access to a subset of MySQL Connectors accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:H).

Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.0.32 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Connectors as well as unauthorized update, insert or delete access to some of MySQL Connectors accessible data and unauthorized read access to a subset of MySQL Connectors accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:H).

These are all security issues fixed in the mysql-connector-java-8.0.33-2.1 package on the GA media of openSUSE Tumbleweed.

This update for mysql-connector-java fixes the following issues:

• CVE-2023-21971: Fixed a crash in MySQL Connectors that could be triggered by an authenticated remote user (bsc#1211247).

• Ship protobuf 3.9.2 compatible generated files to support older distro versions.

• Update to 8.0.32:

  • MysqlDataSource fails to URL encode database name when constructing JDBC URL.
  • serverSideStatementCache ignores resultSetType.
  • UpdatableResultSet does not properly handle unsigned primary key.
  • Connector/J 8 query with explain can not return ResultRow.
  • Add support to row alias on INSERT... ON DUPLICATE KEY UPDATE on batch mode.
  • connectionCollation ignored if characterEncoding is set.
  • Connector/J rejects UNION with CTE.
  • Malformed packet generation for COM_STMT_EXECUTE.
  • Connector/J client hangs after prepare & execute process with old version server.
  • Contribution: Fix name of relocation POM file.
  • Contribution: [PATCH] Remove superfluous use of boxing.
  • Contribution: Recognize 'ON DUPLICATE KEY UPDATE' in 'INSERT SET' Statement.
  • RPM and DEB builds broken after introducing javadoc for maven bundles.
  • Sonatype compliant POM and maven bundles.
  • Upgrade 3rd party libraries and tools.
  • Upgrade Protocol Buffers dependency to protobuf-java-3.21.9.

• As Oracle renamed the package to 'mysql-connector-j', we are 'providing' both names for now, but the package has to be renamed to accommodate the change because the old name will be deprecated at some point in the future without further notice.

• Update to 8.0.31:

  Functionality Added or Changed

  • Important Change: To comply with proper naming guidelines, the Maven groupId and artifactId for Connector/J have been changed to the following starting with this release: groupId: com.mysql artifactId: mysql-connector-j
  • The old groupId and artifactId can still be used for linking the Connector/J library, but they will point to a Maven relocation POM, redirecting users to the new coordinates. Please switch to the new coordinates as soon as possible, as the old coordinates could be discontinued anytime without notice. See Installing Connector/J Using Maven.
  • Also, to go with these changes, the .jar library for Connector/J has been renamed to mysql-connector-j-x.y.z for all channels of distribution by Oracle, not just the Maven repository.
  • Before release 8.0.29, Connector/J always interpolated byte arrays as hexadecimal literals when obtaining a prepared statement's string representation by the toString() method. Since 8.0.29, all byte array values were displayed as ** BYTE ARRAY DATA ** when converted to strings. The same is also true for null values.
  • To allow different ways to display byte array data and null values, a new connection property, maxByteArrayAsHex, has been introduced: byte arrays shorter than the value of maxByteArrayAsHex are now shown as hexadecimal literals like before release 8.0.29. Any byte arrays longer than this value are interpolated generically as ** BYTE ARRAY DATA **.

  Bugs Fixed

  • X DevAPI: When parsing a string into a JSON string, some escape character sequences were not parsed properly, causing the Server to throw a com.mysql.cj.exceptions.WrongArgumentException when receiving the JSON value. This fix ensures that escape sequences are handled properly.
  • X DevAPI: When using the modify() method on JSON documents, any backslashes inside a literal to be used for the modification were lost. This fix corrects the mistakes in the expression parser that caused the issue.
  • Executing a PreparedStatment after applying setFetchSize(0) on it caused an ArrayIndexOutOfBoundsException.
  • Due to some old limitations, when used with Java applets, Connector/J found…

This update for mysql-connector-java fixes the following issues:

• CVE-2023-21971: Fixed a denial-of-service vulnerability in the java.sql.DriverManager.getConnection() method when used with untrusted inputs (bsc#1211247).