Mariadb Connector J
Monthly
Charset-confusion in MariaDB Connector/J (all branches prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9) allows a server-side character set change mid-session to silently decouple the driver's UTF-8 encoding assumption from the server's active encoding. Because the driver continues escaping SQL string literals as UTF-8 while the server parses incoming bytes under a different multi-byte encoding (e.g., GBK or BIG5), the mismatch can defeat byte-wise SQL quoting and enable SQL injection - a well-documented attack class for charset-confusion primitives. No public exploit has been identified and this CVE is not listed in CISA KEV at time of analysis.
MariaDB Connector/J exposes database account passwords in cleartext to on-path attackers or hostile servers when PAM (dialog) authentication is used over plain TCP. The driver's PAM handler (SendPamAuthPacketFactory, plugin name 'dialog') failed to override the requireSsl() gate that correctly protects its sibling mysql_clear_password plugin, inheriting a default value of false and thus omitting the secure-transport requirement. Under the default connector configuration (sslMode=DISABLE, restrictedAuth=null), a man-in-the-middle or rogue server can issue an Authentication Switch Request for the dialog plugin and receive the account password in cleartext, granting full credential reuse against the real database. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but the attack mechanics are straightforward for any on-path attacker against affected deployments.
Cleartext database password disclosure in MariaDB Connector/J (all versions before 2.7.14, 3.3.5, 3.4.3, and 3.5.9) allows an active network man-in-the-middle to capture a victim application's full database password during the initial TLS handshake. The connector's initial-handshake code path transmits a mysql_clear_password authentication response before validating the certificate fingerprint that is supposed to enforce server identity - a guard that the OK-packet and auth-switch paths correctly enforce but that HandshakeResponse.encode() bypasses entirely. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code is identified at time of analysis, though the vulnerability mechanism is fully documented in a vendor-published HackerOne report and GHSA advisory.
Charset-confusion in MariaDB Connector/J (all branches prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9) allows a server-side character set change mid-session to silently decouple the driver's UTF-8 encoding assumption from the server's active encoding. Because the driver continues escaping SQL string literals as UTF-8 while the server parses incoming bytes under a different multi-byte encoding (e.g., GBK or BIG5), the mismatch can defeat byte-wise SQL quoting and enable SQL injection - a well-documented attack class for charset-confusion primitives. No public exploit has been identified and this CVE is not listed in CISA KEV at time of analysis.
MariaDB Connector/J exposes database account passwords in cleartext to on-path attackers or hostile servers when PAM (dialog) authentication is used over plain TCP. The driver's PAM handler (SendPamAuthPacketFactory, plugin name 'dialog') failed to override the requireSsl() gate that correctly protects its sibling mysql_clear_password plugin, inheriting a default value of false and thus omitting the secure-transport requirement. Under the default connector configuration (sslMode=DISABLE, restrictedAuth=null), a man-in-the-middle or rogue server can issue an Authentication Switch Request for the dialog plugin and receive the account password in cleartext, granting full credential reuse against the real database. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but the attack mechanics are straightforward for any on-path attacker against affected deployments.
Cleartext database password disclosure in MariaDB Connector/J (all versions before 2.7.14, 3.3.5, 3.4.3, and 3.5.9) allows an active network man-in-the-middle to capture a victim application's full database password during the initial TLS handshake. The connector's initial-handshake code path transmits a mysql_clear_password authentication response before validating the certificate fingerprint that is supposed to enforce server identity - a guard that the OK-packet and auth-switch paths correctly enforce but that HandshakeResponse.encode() bypasses entirely. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code is identified at time of analysis, though the vulnerability mechanism is fully documented in a vendor-published HackerOne report and GHSA advisory.