Mariadb Connector Nodejs
Monthly
SQL injection in MariaDB Connector/Node.js exposes applications to data exfiltration or modification when using non-default multi-byte character sets (big5, gbk, sjis, cp932, or gb18030) with attacker-controlled Buffer query parameters. Versions prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3 contain a charset-unaware byte-wise escape routine that allows an attacker-supplied lead byte to absorb the connector-inserted backslash (0x5C) as a multi-byte trail byte, leaving the following quote (0x27) unescaped and terminating the SQL string literal. No public exploit code has been identified at time of analysis and this CVE is not in the CISA KEV catalog, but the root technique is well-documented in public security literature as the classic GBK/Big5 multi-byte escape bypass.
PAM dialog authentication in MariaDB Connector/Node.js discloses account passwords in cleartext when connections use plain TCP, because the SendPamAuthPacketFactory handler omitted the secure-transport gate that was already applied to the sibling mysql_clear_password plugin. Applications connecting to MariaDB with default settings (sslMode=DISABLE, restrictedAuth=null) over untrusted network paths are exposed to credential theft by any on-path attacker or rogue server that issues an Authentication Switch Request for the dialog plugin. No active exploitation or public exploit code has been identified; vendor-released patches are available across all active 3.x branches.
SQL injection in MariaDB Connector/Node.js exposes applications to data exfiltration or modification when using non-default multi-byte character sets (big5, gbk, sjis, cp932, or gb18030) with attacker-controlled Buffer query parameters. Versions prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3 contain a charset-unaware byte-wise escape routine that allows an attacker-supplied lead byte to absorb the connector-inserted backslash (0x5C) as a multi-byte trail byte, leaving the following quote (0x27) unescaped and terminating the SQL string literal. No public exploit code has been identified at time of analysis and this CVE is not in the CISA KEV catalog, but the root technique is well-documented in public security literature as the classic GBK/Big5 multi-byte escape bypass.
PAM dialog authentication in MariaDB Connector/Node.js discloses account passwords in cleartext when connections use plain TCP, because the SendPamAuthPacketFactory handler omitted the secure-transport gate that was already applied to the sibling mysql_clear_password plugin. Applications connecting to MariaDB with default settings (sslMode=DISABLE, restrictedAuth=null) over untrusted network paths are exposed to credential theft by any on-path attacker or rogue server that issues an Authentication Switch Request for the dialog plugin. No active exploitation or public exploit code has been identified; vendor-released patches are available across all active 3.x branches.