Severity: moderate

Remote Memory Exposure

mysql

Overview

Versions of mysql before 2.14.0 are vulnerable to remove memory exposure.

Affected versions of mysql package allocate and send an uninitialized memory over the network when a number is provided as a password.

Only mysql running on Node.js versions below 6.0.0 is affected due to a throw added in newer node.js versions.

Proof of Concept:

require('mysql').createConnection({
  host: 'localhost',
  user: 'user',
  password : USERPROVIDEDINPUT,  // number
  database : 'my_db'
}).connect();

Remediation

Update to version 2.14.0 or later.

Resources

Advisory timeline

  1. published

    Advisory published
    Apr 25th, 2018
  2. reported

    Apr 24th, 2018