MariaDB Connector/J: Rogue server can make the client read past the packet through server-declared lengths
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 3.3.7, 3.4.5, 3.5.11
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
MariaDB Connector/J, the Java JDBC driver used to connect applications to MariaDB and MySQL databases, is affected. A malicious or compromised database server, or an attacker intercepting the connection, could send crafted packets that cause the driver to read beyond packet boundaries, leading to crashes that terminate connection handling.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, decoders for OK packet session-state blocks, column definition packets, text row data, or binary row data used server-declared lengths without confirming that the requested bytes remained in the receive buffer. The decoders could position reads, create sub-buffers, or decode strings beyond the packet boundary. A malicious or compromised server, or a machine-in-the-middle attacker, could trigger unchecked ArrayIndexOutOfBoundsException or IllegalArgumentException failures inside JDBC calls and terminate connection handling. This issue is fixed in versions 3.3.7, 3.4.5, and 3.5.11.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- mariadb-corporation mariadb-connector-j
From 3.0.0 · fixed in 3.3.7; From 3.4.0 · fixed in 3.4.5; From 3.5.0 · fixed in 3.5.11