GHSA-5f7m-mmpc-qhh4 mysql Node.JS Module Vulnerable to Remote Memory Exposure

Not scored Published 23 May 2019

An attacker can cause the mysql Node.js library to leak uninitialized memory over the network by providing a numeric password.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is GHSA-5f7m-mmpc-qhh4?

GHSA-5f7m-mmpc-qhh4 is a vulnerability in mysql, published on 23 May 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Versions of mysql before 2.14.0 are vulnerable to remove memory exposure.

Affected versions of mysql package allocate and send an uninitialized memory over the network when a number is provided as a password.

Only mysql running on Node.js versions below 6.0.0 are affected due to a throw added in newer node.js versions.

Proof of Concept:

require(&#39;mysql&#39;).createConnection({
  host: &#39;localhost&#39;,
  user: &#39;user&#39;,
  password : USERPROVIDEDINPUT,  // number
  database : &#39;my_db&#39;
}).connect();

Recommendation

Update to version 2.14.0 or later.

Which versions are affected by GHSA-5f7m-mmpc-qhh4?

2 open source packages ship an affected version, including mysql.

Package	Affected	Fixed in
`mysql` npm	From `2.0.0-alpha8`	`2.14.0`
`mysql` npm	From `2.0.0-alpha8`	`2.14.0`

How do I fix GHSA-5f7m-mmpc-qhh4?

Upgrade mysql to 2.14.0 or later.

Is GHSA-5f7m-mmpc-qhh4 being exploited?

There is no known exploitation of GHSA-5f7m-mmpc-qhh4 in the wild and no public exploit code.