CVE-2016-5598
MySQL Connector 2.1.3 and earlier, 2.0.4 and earlier: Remote attack impacts confidentiality, integrity, availability via Connector/Python
- CVSS 5.6
- CWE-284 Improper Access Control
- Memory Corruption
- Remote
Unspecified vulnerability in the MySQL Connector component 2.1.3 and earlier and 2.0.4 and earlier in Oracle MySQL allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Connector/Python.
- CVSS base score
- 5.6
- Published
- 2016-10-25
- OWASP
- A08 Software and Data Integrity Failures
- Orthogonal defect classification
- Function
- Code defect classification
- Incorrect Functionality
- Category
- Memory Corruption
- Subcategory
- Out-of-Bound Accesses
- Accessibility scope
- Remote
- Impact
- Denial of Service (DoS)
- Fixed by upgrading
- Yes
Solution
Update MySQL Connector to a version higher than 2.1.3 or 2.0.4.
Vulnerable code sample
import mysql.connector
def database_connection(host, user, password, database):
try:
connection = mysql.connector.connect(
host=host,
user=user,
password=password,
database=database
)
print("Connection established without SSL.")
return connection
except mysql.connector.Error as err:
print(f"Error: {err}")Patched code sample
import mysql.connector
from mysql.connector import errorcode
def database_connection(host, user, password, database):
try:
connection = mysql.connector.connect(
host=host,
user=user,
password=password,
database=database,
ssl_disabled=False,
ssl_ca='path/to/ca-cert.pem',
ssl_cert='path/to/client-cert.pem',
ssl_key='path/to/client-key.pem'
)
print("Connection established securely.")
return connection
except mysql.connector.Error as err:
if err.errno == errorcode.ER_ACCESS_DENIED_ERROR:
print("Something is wrong with your user name or password")
elif err.errno == errorcode.ER_BAD_DB_ERROR:
print("Database does not exist")
else:
print(err)
except Exception as e:
print(f"An error occurred: {e}")Cite this entry
@misc{vaitp:cve20165598,
title = {{MySQL Connector 2.1.3 and earlier, 2.0.4 and earlier: Remote attack impacts confidentiality, integrity, availability via Connector/Python}},
author = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
year = {2016},
note = {VAITP Python Vulnerability Dataset, entry CVE-2016-5598},
howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2016-5598/}}
}Introducing the "VAITP dataset": a specialized repository of Python vulnerabilities and patches, meticulously compiled for the use of the security research community. As Python's prominence grows, understanding and addressing potential security vulnerabilities become crucial. Crafted by and for the cybersecurity community, this dataset offers a valuable resource for researchers, analysts, and developers to analyze and mitigate the security risks associated with Python. Through the comprehensive exploration of vulnerabilities and corresponding patches, the VAITP dataset fosters a safer and more resilient Python ecosystem, encouraging collaborative advancements in programming security.
The supreme art of war is to subdue the enemy without fighting.
Sun Tzu – “The Art of War”
:: Shaping the future through research and ingenuity ::