CVE-2022-31026 Use of Uninitialized Variable in trilogy
A malicious MySQL server can leak up to 12 bytes of stack memory from the trilogy client library during authentication.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-31026?
CVE-2022-31026 is a medium-severity vulnerability in github trilogy, published on 6 Jun 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Trilogy is a client library for MySQL. When authenticating, a malicious server could return a specially crafted authentication packet, causing the client to read and return up to 12 bytes of data from an uninitialized variable in stack memory. Users of the trilogy gem should upgrade to version 2.1.1 This issue can be avoided by only connecting to trusted servers.
Weakness: CWE-908
Which versions are affected by CVE-2022-31026?
2 open source packages ship an affected version, including trilogy. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
trilogy RubyGems | All versions | 2.1.1 |
trilogy RubyGems | All versions | 2.1.1 |
Products include Trilogy Project Trilogy.
How do I fix CVE-2022-31026?
Upgrade trilogy to 2.1.1 or later.
Is CVE-2022-31026 being exploited?
There is no known exploitation of CVE-2022-31026 in the wild and no public exploit code.
Sources
Also known as GHSA-5g4r-2qhx-vqfm.