Every CVE Search/ Get API key

CVE-2024-21272

MySQL Connector/Python connector takeover vulnerability

7.5 HighFix available

Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Python). Supported versions that are affected are 9.0.0 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.51%Up 0.5 points since Oct 16, 2024
90%50%10%1%

What each source reports

CVE List Score used 7.5

Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Python). Supported versions that are affected are 9.0.0 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

Record
CVE-2024-21272
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-306
Updated
2026-11-02
EUVDEUVD-2024-3056 7.5

Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Python). Supported versions that are affected are 9.0.0 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

Record
EUVD-2024-3056
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-03
GitHub AdvisoriesGHSA-hgjp-83m4-h4fj 7.7

MySQL Connector/Python connector takeover vulnerability

Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Python). Supported versions that are affected are 9.0.0 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

Record
GHSA-hgjp-83m4-h4fj
CVSS 4.0
7.7 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-89
Updated
2026-11-02
NVD 7.5

Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Python). Supported versions that are affected are 9.0.0 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

Record
CVE-2024-21272
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-306
Updated
2026-11-02
OSV 7.5

Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Python). Supported versions that are affected are 9.0.0 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

Record
CVE-2024-21272
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVGHSA-hgjp-83m4-h4fj 7.7

MySQL Connector/Python connector takeover vulnerability

Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Python). Supported versions that are affected are 9.0.0 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

Record
GHSA-hgjp-83m4-h4fj
CVSS 4.0
7.7 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-89
Updated
2026-11-02
Show 6 moreShow less
OSVPYSEC-2026-1685 7.7

MySQL Connector/Python connector takeover vulnerability

Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Python). Supported versions that are affected are 9.0.0 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

Record
PYSEC-2026-1685
CVSS 4.0
7.7 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2024-21272 7.5

Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Python). Supported versions that are affected are 9.0.0 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

Record
UBUNTU-CVE-2024-21272
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVCLSA-2025-1765930332 No score

TuxCare security update for mysql-connector-python (1 CVE)

TuxCare rebuilt mysql-connector-python to address 1 CVE. Fixed in 8.4.0.post1+tuxcare.

Record
CLSA-2025-1765930332
Updated
2026-11-02
OSVopenSUSE-SU-2024:0351-1 No score

Security update for python-mysql-connector-python

This update for python-mysql-connector-python fixes the following issues:

  • Update to 9.1.0 (boo#1231740, CVE-2024-21272)
    • WL#16452: Bundle all installable authentication plugins when building the C-extension
    • WL#16444: Drop build support for DEB packages
    • WL#16442: Upgrade gssapi version to 1.8.3
    • WL#16411: Improve wheel metadata information for Classic and XDevAPI connectors
    • WL#16341: OpenID Connect (Oauth2 - JWT) Authentication Support
    • WL#16307: Remove Python 3.8 support
    • WL#16306: Add support for Python 3.13
    • BUG#37055435: Connection fails during the TLS negotiation when specifying TLSv1.3 ciphers
    • BUG#37013057: mysql-connector-python Parameterized query SQL injection
    • BUG#36765200: python mysql connector 8.3.0 raise %-.100s:%u when input a wrong host
    • BUG#36577957: Update charset/collation description indicate this is 16 bits
  • 9.0.0:
    • WL#16350: Update dnspython version
    • WL#16318: Deprecate Cursors Prepared Raw and Named Tuple
    • WL#16284: Update the Python Protobuf version
    • WL#16283: Remove OpenTelemetry Bundled Installation
    • BUG#36664998: Packets out of order error is raised while changing user in aio
    • BUG#36611371: Update dnspython required versions to allow latest 2.6.1
    • BUG#36570707: Collation set on connect using C-Extension is ignored
    • BUG#36476195: Incorrect escaping in pure Python mode if sql_mode includes NO_BACKSLASH_ESCAPES
    • BUG#36289767: MySQLCursorBufferedRaw does not skip conversion
  • 8.4.0
    • WL#16203: GPL License Exception Update
    • WL#16173: Update allowed cipher and cipher-suite lists
    • WL#16164: Implement support for new vector data type
    • WL#16127: Remove the FIDO authentication mechanism
    • WL#16053: Support GSSAPI/Kerberos authentication on Windows using authentication_ldap_sasl_client plug-in for C-extension
    • BUG#36227964: Improve OpenTelemetry span coverage
    • BUG#36167880: Massive memory leak mysqlx native Protobuf adding to collection
  • 8.3.0
    • WL#16015: Remove use of removed COM_ commands
    • WL#15985: Support GSSAPI/Kerberos authentication on Windows using authentication_ldap_sasl_client plug-in for Pure Python
    • WL#15983: Stop using mysql_ssl_set api
    • WL#15982: Remove use of mysql_shutdown
    • WL#15950: Support query parameters for prepared statements
    • WL#15942: Improve type hints and standardize byte type handling
    • WL#15836: Split mysql and mysqlx into different packages
    • WL#15523: Support Python DB API asynchronous execution
    • BUG#35912790: Binary strings are converted when using prepared statements
    • BUG#35832148: Fix Django timezone.utc deprecation warning
    • BUG#35710145: Bad MySQLCursor.statement and result when query text contains code comments
    • BUG#21390859: STATEMENTS GET OUT OF SYNCH WITH RESULT SETS
Record
openSUSE-SU-2024:0351-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:14421-1 No score

python310-mysql-connector-python-9.1.0-1.1 on GA media

These are all security issues fixed in the python310-mysql-connector-python-9.1.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:14421-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:12019-1 No score

python313-mysql-connector-python-9.7.0-1.2 on GA media

These are all security issues fixed in the python313-mysql-connector-python-9.7.0-1.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:12019-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
mysql-connector-python
PyPI
 before 9.1.0
9.1.0
mysql-connector-python
TuxCare:PyPI
 8.4.0 up to 8.4.0.post1+tuxcare
8.4.0.post1+tuxcare
mysql-connector-python
PyPI
 before 9.1.0, plus listed versions
8.0.218.0.228.0.238.0.248.0.25
Show 14 moreShow less
8.0.268.0.278.0.288.0.298.0.308.0.318.0.328.0.338.0.58.1.08.2.08.3.08.4.09.0.0
9.1.0
mysql-connector-python
Ubuntu:16.04:LTS
 All versions, plus listed versions
2.0.4-1
 None known
mysql-connector-python
Ubuntu:18.04:LTS
 All versions, plus listed versions
2.1.6-1
 None known
mysql-connector-python
Ubuntu:20.04:LTS
 All versions, plus listed versions
8.0.15-18.0.15-2build1
 None known
mysql-connector-python
Ubuntu:22.04:LTS
 All versions, plus listed versions
8.0.15-2build1
 None known
mysql-connector-python
Ubuntu:24.04:LTS
 All versions, plus listed versions
8.0.15-38.0.15-4
 None known
python-mysql-connector-python
SUSE:Package Hub 15 SP5
 before 9.1.0-bp155.3.3.1
9.1.0-bp155.3.3.1
python-mysql-connector-python
openSUSE:Leap 15.5
 before 9.1.0-bp155.3.3.1
9.1.0-bp155.3.3.1
python-mysql-connector-python
openSUSE:Tumbleweed
 before 9.1.0-1.1
9.1.0-1.1
python-mysql-connector-python
openSUSE:Tumbleweed
From an advisory covering 3 CVEs
 before 9.7.0-1.2
9.7.0-1.2

History

History
RecordedChangedSources
affected, facts
aliases, publishedEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-21272 is a high vulnerability (CVSS 7.5) in Oracle Mysql, published October 15, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.51%, the 44th percentile. Fixed in mysql-connector-python 9.1.0.

References

Show 8 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open