{"id":"CVE-2017-3586","aliases":["DLA-945-1","DSA-3857-1","EUVD-2022-4838","GHSA-pwh7-92h3-mqr6","MGASA-2017-0382","SUSE-SU-2017:2591-1","UBUNTU-CVE-2017-3586"],"status":"published","title":"Exposure of Sensitive Information to an Unauthorized Actor in Oracle MySQL Connectors Java","description":"Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/J). Supported versions that are affected are 5.1.41 and earlier. Easily \"exploitable\" vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. While the vulnerability is in MySQL Connectors, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Connectors accessible data as well as unauthorized read access to a subset of MySQL Connectors accessible data. CVSS 3.0 Base Score 6.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N).","severity":{"version":"3.0","score":6.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01713,"percentile":0.77542,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2017-04-24T19:00:00Z","modified":"2026-06-17T01:18:38Z","fixes":[{"ecosystem":"Maven","package":"mysql:mysql-connector-java","fixed_in":["5.1.42"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"mysql:mysql-connector-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"5.1.41"},{"fixed":"5.1.42"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"mysql-connector-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.42-1~deb7u1"}]}],"versions":["5.1.16-2","5.1.25-1","5.1.26-1","5.1.27-1","5.1.28-1","5.1.29-1","5.1.30-1","5.1.31-1","5.1.32-1","5.1.37-1","5.1.38-1","5.1.39-1","5.1.39-1~deb7u1","5.1.39-1~deb8u1","5.1.40-1","5.1.41-1","5.1.41-1~deb8u1"],"bundled":3},{"source":"osv","ecosystem":"Debian:8","package":"mysql-connector-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.42-1~deb8u1"}]}],"versions":["5.1.32-1","5.1.37-1","5.1.38-1","5.1.39-1","5.1.39-1~deb7u1","5.1.39-1~deb8u1","5.1.40-1","5.1.41-1","5.1.41-1~deb8u1","5.1.42-1~deb7u1"],"bundled":2},{"source":"osv","ecosystem":"Maven","package":"mysql:mysql-connector-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.42"}]}],"versions":["2.0.14","3.0.10","3.0.8","3.1.11","3.1.12","3.1.13","3.1.14","5.0.2","5.0.3","5.0.4","5.0.5","5.0.7","5.0.8","5.1.1","5.1.10","5.1.11","5.1.12","5.1.13","5.1.14","5.1.15","5.1.16","5.1.17","5.1.18","5.1.19","5.1.2","5.1.20","5.1.21","5.1.22","5.1.23","5.1.24","5.1.25","5.1.26","5.1.27","5.1.28","5.1.29","5.1.3","5.1.30","5.1.31","5.1.32","5.1.33","5.1.34","5.1.35","5.1.36","5.1.37","5.1.38","5.1.39","5.1.4","5.1.40","5.1.41","5.1.5","5.1.6","5.1.8","5.1.9"]},{"source":"osv","ecosystem":"Mageia:5","package":"mysql-connector-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.42-1.mga5"}]}],"bundled":3},{"source":"osv","ecosystem":"Mageia:6","package":"mysql-connector-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.42-1.mga6"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"mysql-connector-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.42-5.4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"mysql-connector-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.42-5.4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"mysql-connector-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.1.25-1","5.1.26-1","5.1.27-1","5.1.28-1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"mysql-connector-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.1.32-1","5.1.38-1"]}],"products":[{"vendor":"oracle","product":"mysql_connectors"},{"vendor":"oracle corporation","product":"mysql connectors"}],"references":[{"url":"http://www.securitytracker.com/id/1038287","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","web","report"]},{"url":"http://www.debian.org/security/2017/dsa-3857","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","web"]},{"url":"http://www.securityfocus.com/bid/97982","tags":["vdb-entry","x_refsource_BID","x_transferred","Not Applicable"]},{"url":"http://www.securityfocus.com/bid/97784","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-3586","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-pwh7-92h3-mqr6"},{"url":"https://advisories.mageia.org/MGASA-2017-0382.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=20731","tags":["report"]},{"url":"https://www.computest.nl/advisories/CT-2017-0425_MySQL-Connector-J.txt","tags":["advisory"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html#AppendixMSQL","tags":["advisory"]},{"url":"https://www.debian.org/security/2017/dsa-3840","tags":["web"]},{"url":"https://www.debian.org/security/2017/dsa-3857","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20172591-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1035210","tags":["report"]},{"url":"https://bugzilla.suse.com/1035211","tags":["report"]},{"url":"https://bugzilla.suse.com/1035697","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-3523","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-3586","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-3589","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2017-3586","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-3586","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2017-3586","description":"Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/J). Supported versions that are affected are 5.1.41 and earlier. Easily \"exploitable\" vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. While the vulnerability is in MySQL Connectors, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Connectors accessible data as well as unauthorized read access to a subset of MySQL Connectors accessible data. CVSS 3.0 Base Score 6.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N).","status":"published","published":"2017-04-24T19:00:00Z","modified":"2024-10-07T16:10:20.323Z","updated_at":"2026-11-02T14:33:16.578111Z"}],"euvd":[{"id":"EUVD-2022-4838","description":"Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/J). Supported versions that are affected are 5.1.41 and earlier. Easily \"exploitable\" vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. While the vulnerability is in MySQL Connectors, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Connectors accessible data as well as unauthorized read access to a subset of MySQL Connectors accessible data. CVSS 3.0 Base Score 6.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N).","status":"published","published":"2017-04-24T19:00:00Z","modified":"2024-10-07T16:10:20Z","updated_at":"2026-11-03T00:27:46.862342Z"}],"ghsa":[{"id":"GHSA-pwh7-92h3-mqr6","title":"Exposure of Sensitive Information to an Unauthorized Actor in Oracle MySQL Connectors Java","description":"Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/J). Supported versions that are affected are 5.1.41 and earlier. Easily \"exploitable\" vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. While the vulnerability is in MySQL Connectors, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Connectors accessible data as well as unauthorized read access to a subset of MySQL Connectors accessible data. CVSS 3.0 Base Score 6.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N).","status":"published","published":"2022-05-13T01:45:42Z","modified":"2023-01-27T05:02:17Z","cvss":[{"version":"3.0","score":6.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:36:17.742171Z"}],"nvd":[{"id":"CVE-2017-3586","description":"Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/J). Supported versions that are affected are 5.1.41 and earlier. Easily \"exploitable\" vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. While the vulnerability is in MySQL Connectors, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Connectors accessible data as well as unauthorized read access to a subset of MySQL Connectors accessible data. CVSS 3.0 Base Score 6.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N).","status":"published","published":"2017-04-24T19:59:05.597Z","modified":"2026-06-17T01:18:38.683Z","cvss":[{"version":"3.0","score":6.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":5.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:03:46.08744Z"}],"osv":[{"id":"GHSA-pwh7-92h3-mqr6","title":"Exposure of Sensitive Information to an Unauthorized Actor in Oracle MySQL Connectors Java","description":"Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/J). Supported versions that are affected are 5.1.41 and earlier. Easily \"exploitable\" vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. While the vulnerability is in MySQL Connectors, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Connectors accessible data as well as unauthorized read access to a subset of MySQL Connectors accessible data. CVSS 3.0 Base Score 6.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N).","status":"published","published":"2022-05-13T01:45:42Z","modified":"2023-11-08T03:59:21.205746Z","cvss":[{"version":"3.0","score":6.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:46:53.700556Z"},{"id":"UBUNTU-CVE-2017-3586","description":"Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/J). Supported versions that are affected are 5.1.41 and earlier. Easily \"exploitable\" vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. While the vulnerability is in MySQL Connectors, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Connectors accessible data as well as unauthorized read access to a subset of MySQL Connectors accessible data. CVSS 3.0 Base Score 6.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N).","status":"published","published":"2017-04-24T19:59:00Z","modified":"2025-10-24T04:46:07Z","cvss":[{"version":"3.0","score":6.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:15.388065Z"},{"id":"DLA-945-1","title":"mysql-connector-java - security update","status":"published","published":"2017-05-16T00:00:00Z","modified":"2026-03-09T02:10:56.19099Z","updated_at":"2026-11-02T15:46:13.584509Z"},{"id":"DSA-3857-1","title":"mysql-connector-java - security update","status":"published","published":"2017-05-18T00:00:00Z","modified":"2026-03-09T01:20:46.629699Z","updated_at":"2026-11-02T15:46:16.523846Z"},{"id":"MGASA-2017-0382","title":"Updated mysql-connector-java packages fix security vulnerabilities","description":"Thijs Alkemade discovered that unexpected automatic deserialisation of\nJava objects in the MySQL Connector/J JDBC driver may result in the\nexecution of arbitary code (CVE-2017-3523).\n\nTwo vulnerabilities have been found in the MySQL Connector/J JDBC driver\n(CVE-2017-3586, CVE-2017-3589).\n","status":"published","published":"2017-10-24T05:50:58Z","modified":"2026-04-16T06:25:15.755628211Z","updated_at":"2026-11-02T15:49:40.442238Z"},{"id":"SUSE-SU-2017:2591-1","title":"Security update for mysql-connector-java","description":"This update for mysql-connector-java to version to 5.1.42 fixes several issues.\n\nThese security issues were fixed:\n\n- CVE-2017-3589: An unspecified vulnerability in MySQL Connector/J could have resulted in unauthorized update, insert or delete access to some of MySQL Connectors accessible data (bnc#1035210)\n- CVE-2017-3523: An unspecified vulnerability in MySQL Connector/J could have lead to takeover of MySQL Connectors (bnc#1035697)\n- CVE-2017-3586: An unspecified vulnerability in MySQL Connectors could have lead to unauthorized update, insert or delete access to some of MySQL Connectors accessible data as well as unauthorized read access to a subset of MySQL Connectors accessible data (bnc#1035211)\n\nMore infos are available at http://dev.mysql.com/doc/relnotes/connector-j/en/news-5-1.html\n","status":"published","published":"2017-09-28T11:50:16Z","modified":"2026-02-04T02:44:03.426514Z","updated_at":"2026-11-02T15:53:44.209561Z"}]}}