{"id":"CVE-2017-3589","aliases":["DLA-945-1","DSA-3857-1","EUVD-2022-3587","GHSA-cjcf-wm2p-59h5","MGASA-2017-0382","SUSE-SU-2017:2591-1","UBUNTU-CVE-2017-3589","openSUSE-SU-2024:11071-1"],"status":"published","title":"Exposure of Sensitive Information to an Unauthorized Actor in Oracle MySQL Connectors Java","description":"Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/J). Supported versions that are affected are 5.1.41 and earlier. Easily \"exploitable\" vulnerability allows low privileged attacker with logon to the infrastructure where MySQL Connectors executes to compromise MySQL Connectors. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Connectors accessible data. CVSS 3.0 Base Score 3.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N).","severity":{"version":"3.0","score":3.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00466,"percentile":0.40558,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2017-04-24T19:00:00Z","modified":"2026-06-17T01:18:39Z","fixes":[{"ecosystem":"Maven","package":"mysql:mysql-connector-java","fixed_in":["5.1.42"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"mysql:mysql-connector-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"5.1.41"},{"fixed":"5.1.42"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"mysql-connector-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.42-1~deb7u1"}]}],"versions":["5.1.16-2","5.1.25-1","5.1.26-1","5.1.27-1","5.1.28-1","5.1.29-1","5.1.30-1","5.1.31-1","5.1.32-1","5.1.37-1","5.1.38-1","5.1.39-1","5.1.39-1~deb7u1","5.1.39-1~deb8u1","5.1.40-1","5.1.41-1","5.1.41-1~deb8u1"],"bundled":3},{"source":"osv","ecosystem":"Debian:8","package":"mysql-connector-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.42-1~deb8u1"}]}],"versions":["5.1.32-1","5.1.37-1","5.1.38-1","5.1.39-1","5.1.39-1~deb7u1","5.1.39-1~deb8u1","5.1.40-1","5.1.41-1","5.1.41-1~deb8u1","5.1.42-1~deb7u1"],"bundled":2},{"source":"osv","ecosystem":"Maven","package":"mysql:mysql-connector-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.42"}]}],"versions":["2.0.14","3.0.10","3.0.8","3.1.11","3.1.12","3.1.13","3.1.14","5.0.2","5.0.3","5.0.4","5.0.5","5.0.7","5.0.8","5.1.1","5.1.10","5.1.11","5.1.12","5.1.13","5.1.14","5.1.15","5.1.16","5.1.17","5.1.18","5.1.19","5.1.2","5.1.20","5.1.21","5.1.22","5.1.23","5.1.24","5.1.25","5.1.26","5.1.27","5.1.28","5.1.29","5.1.3","5.1.30","5.1.31","5.1.32","5.1.33","5.1.34","5.1.35","5.1.36","5.1.37","5.1.38","5.1.39","5.1.4","5.1.40","5.1.41","5.1.5","5.1.6","5.1.8","5.1.9"]},{"source":"osv","ecosystem":"Mageia:5","package":"mysql-connector-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.42-1.mga5"}]}],"bundled":3},{"source":"osv","ecosystem":"Mageia:6","package":"mysql-connector-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.42-1.mga6"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"mysql-connector-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.42-5.4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"mysql-connector-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.42-5.4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"mysql-connector-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.1.25-1","5.1.26-1","5.1.27-1","5.1.28-1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"mysql-connector-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.1.32-1","5.1.38-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"mysql-connector-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.25-2.2"}]}],"bundled":3}],"products":[{"vendor":"oracle","product":"connector\\/j"},{"vendor":"oracle corporation","product":"mysql connectors"}],"references":[{"url":"http://www.securityfocus.com/bid/97836","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1038287","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","web","report"]},{"url":"http://www.debian.org/security/2017/dsa-3857","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-3589","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-cjcf-wm2p-59h5"},{"url":"https://advisories.mageia.org/MGASA-2017-0382.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=20731","tags":["report"]},{"url":"https://www.computest.nl/advisories/CT-2017-0425_MySQL-Connector-J.txt","tags":["advisory"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html#AppendixMSQL","tags":["advisory"]},{"url":"https://www.debian.org/security/2017/dsa-3840","tags":["web"]},{"url":"https://www.debian.org/security/2017/dsa-3857","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20172591-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1035210","tags":["report"]},{"url":"https://bugzilla.suse.com/1035211","tags":["report"]},{"url":"https://bugzilla.suse.com/1035697","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-3523","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-3586","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-3589","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2017-3589","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-3589","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2020-2875","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2017-3589","description":"Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/J). Supported versions that are affected are 5.1.41 and earlier. Easily \"exploitable\" vulnerability allows low privileged attacker with logon to the infrastructure where MySQL Connectors executes to compromise MySQL Connectors. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Connectors accessible data. CVSS 3.0 Base Score 3.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N).","status":"published","published":"2017-04-24T19:00:00Z","modified":"2024-10-07T16:10:03.607Z","updated_at":"2026-11-02T14:33:15.887816Z"}],"euvd":[{"id":"EUVD-2022-3587","description":"Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/J). Supported versions that are affected are 5.1.41 and earlier. Easily \"exploitable\" vulnerability allows low privileged attacker with logon to the infrastructure where MySQL Connectors executes to compromise MySQL Connectors. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Connectors accessible data. CVSS 3.0 Base Score 3.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N).","status":"published","published":"2017-04-24T19:00:00Z","modified":"2024-10-07T16:10:03Z","updated_at":"2026-11-03T00:27:46.862342Z"}],"ghsa":[{"id":"GHSA-cjcf-wm2p-59h5","title":"Exposure of Sensitive Information to an Unauthorized Actor in Oracle MySQL Connectors Java","description":"Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/J). Supported versions that are affected are 5.1.41 and earlier. Easily \"exploitable\" vulnerability allows low privileged attacker with logon to the infrastructure where MySQL Connectors executes to compromise MySQL Connectors. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Connectors accessible data. CVSS 3.0 Base Score 3.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N).","status":"published","published":"2022-05-13T01:45:42Z","modified":"2023-01-27T05:02:10Z","cvss":[{"version":"3.0","score":3.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:36:17.04874Z"}],"nvd":[{"id":"CVE-2017-3589","description":"Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/J). Supported versions that are affected are 5.1.41 and earlier. Easily \"exploitable\" vulnerability allows low privileged attacker with logon to the infrastructure where MySQL Connectors executes to compromise MySQL Connectors. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Connectors accessible data. CVSS 3.0 Base Score 3.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N).","status":"published","published":"2017-04-24T19:59:05.66Z","modified":"2026-06-17T01:18:39.127Z","cvss":[{"version":"3.0","score":3.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"primary"},{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:N/I:P/A:N","level":"low","assessor":"primary"}],"updated_at":"2026-11-02T14:03:46.08744Z"}],"osv":[{"id":"GHSA-cjcf-wm2p-59h5","title":"Exposure of Sensitive Information to an Unauthorized Actor in Oracle MySQL Connectors Java","description":"Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/J). Supported versions that are affected are 5.1.41 and earlier. Easily \"exploitable\" vulnerability allows low privileged attacker with logon to the infrastructure where MySQL Connectors executes to compromise MySQL Connectors. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Connectors accessible data. CVSS 3.0 Base Score 3.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N).","status":"published","published":"2022-05-13T01:45:42Z","modified":"2023-11-08T03:59:21.268032Z","cvss":[{"version":"3.0","score":3.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:46:45.28161Z"},{"id":"UBUNTU-CVE-2017-3589","description":"Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/J). Supported versions that are affected are 5.1.41 and earlier. Easily \"exploitable\" vulnerability allows low privileged attacker with logon to the infrastructure where MySQL Connectors executes to compromise MySQL Connectors. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Connectors accessible data. CVSS 3.0 Base Score 3.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N).","status":"published","published":"2017-04-24T19:59:00Z","modified":"2025-10-24T04:46:07Z","cvss":[{"version":"3.0","score":3.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T15:54:15.388065Z"},{"id":"DLA-945-1","title":"mysql-connector-java - security update","status":"published","published":"2017-05-16T00:00:00Z","modified":"2026-03-09T02:10:56.19099Z","updated_at":"2026-11-02T15:46:13.584509Z"},{"id":"DSA-3857-1","title":"mysql-connector-java - security update","status":"published","published":"2017-05-18T00:00:00Z","modified":"2026-03-09T01:20:46.629699Z","updated_at":"2026-11-02T15:46:16.523846Z"},{"id":"MGASA-2017-0382","title":"Updated mysql-connector-java packages fix security vulnerabilities","description":"Thijs Alkemade discovered that unexpected automatic deserialisation of\nJava objects in the MySQL Connector/J JDBC driver may result in the\nexecution of arbitary code (CVE-2017-3523).\n\nTwo vulnerabilities have been found in the MySQL Connector/J JDBC driver\n(CVE-2017-3586, CVE-2017-3589).\n","status":"published","published":"2017-10-24T05:50:58Z","modified":"2026-04-16T06:25:15.755628211Z","updated_at":"2026-11-02T15:49:40.442238Z"},{"id":"openSUSE-SU-2024:11071-1","title":"mysql-connector-java-8.0.25-2.2 on GA media","description":"These are all security issues fixed in the mysql-connector-java-8.0.25-2.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:14:52.835327Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-SU-2017:2591-1","title":"Security update for mysql-connector-java","description":"This update for mysql-connector-java to version to 5.1.42 fixes several issues.\n\nThese security issues were fixed:\n\n- CVE-2017-3589: An unspecified vulnerability in MySQL Connector/J could have resulted in unauthorized update, insert or delete access to some of MySQL Connectors accessible data (bnc#1035210)\n- CVE-2017-3523: An unspecified vulnerability in MySQL Connector/J could have lead to takeover of MySQL Connectors (bnc#1035697)\n- CVE-2017-3586: An unspecified vulnerability in MySQL Connectors could have lead to unauthorized update, insert or delete access to some of MySQL Connectors accessible data as well as unauthorized read access to a subset of MySQL Connectors accessible data (bnc#1035211)\n\nMore infos are available at http://dev.mysql.com/doc/relnotes/connector-j/en/news-5-1.html\n","status":"published","published":"2017-09-28T11:50:16Z","modified":"2026-02-04T02:44:03.426514Z","updated_at":"2026-11-02T15:53:44.209561Z"}]}}