K000139680: MySQL2 vulnerability CVE-2024-21508

Security Advisory Description Versions of the package mysql2 before 3.9.4 are vulnerable to Remote Code Execution RCE via the readCodeFor function due to improper validation of the supportBigNumbers and bigNumberStrings values. CVE-2024-21508 Impact There is no impact; F5 products are not affecte...

@1px-no/img (>=4.2.3, <=4.2.50), @5minds/processcube_engine (>=15.0.0, <=18.0.0-renovate-aee2c3-lw4ddkx5) +148 more potentially affected by CVE-2024-21512 via mysql2 (>=3.0.0, <=3.9.7)

mysql2 NPM version =3.0.0, =4.2.3, =15.0.0, =1.0.0, =1.0.6-beta.0, =1.0.0, =15.0.0-alpha.2, =0.1.0, =0.1.0, =0.1.0, =1.0.75, =4.38.0, =4.0.1-alpha, =0.20.0, =0.52.0, =0.62.20 and more Source cves: CVE-2024-21512 Source advisory: SNYK:JS-MYSQL2-6861580...

@5minds/processcube_engine (>=15.0.0, <=17.0.0-renovate-fffeda-lowoukm9), @alexop/express-mysql-session (2.2.0) +143 more potentially affected by CVE-2024-21511 via mysql2 (>=3.0.0, <=3.9.6)

mysql2 NPM version =3.0.0, =15.0.0, =1.0.6-beta.0, =1.0.0, =15.0.0-alpha.2, =0.1.0, =0.1.0, =0.1.0, =1.0.75, =4.38.0, =4.0.1-alpha, =0.20.0, =0.52.0, =1.6.0, =2.9.24-alpha.2, =2.23.12 and more Source cves: CVE-2024-21511 Source advisory: OSV:GHSA-4RCH-2FH8-94VW...

GHSA-4RCH-2FH8-94VW MySQL2 for Node Arbitrary Code Injection

Versions of the package mysql2 before 3.9.7 are vulnerable to Arbitrary Code Injection due to improper sanitization of the timezone parameter in the readCodeFor function by calling a native MySQL Server date/time function...

MySQL2 for Node Arbitrary Code Injection

Versions of the package mysql2 before 3.9.7 are vulnerable to Arbitrary Code Injection due to improper sanitization of the timezone parameter in the readCodeFor function by calling a native MySQL Server date/time function...

CVE-2024-21511

Versions of the package mysql2 before 3.9.7 are vulnerable to Arbitrary Code Injection due to improper sanitization of the timezone parameter in the readCodeFor function by calling a native MySQL Server date/time function...

CVE-2024-21511

Versions of the package mysql2 before 3.9.7 are vulnerable to Arbitrary Code Injection due to improper sanitization of the timezone parameter in the readCodeFor function by calling a native MySQL Server date/time function...

CVE-2024-21511

Summary : The CVE-2024-21511 entry concerns the npm package mysql2, where versions before 3.9.7 are vulnerable to arbitrary code injection due to improper sanitization of the timezone parameter in the readCodeFor function, which triggers a native MySQL Server date/time function access. Affected s...

CVE-2024-21511: Improper Control of Generation of Code

Versions of the package mysql2 before 3.9.7 are vulnerable to Arbitrary Code Injection due to improper sanitization of the timezone parameter in the readCodeFor function by calling a native MySQL Server date/time function...

mysql2 安全漏洞

MySQL2 is a MySQL client for Node.js by Andrey Sidorov, a personal developer. A security vulnerability exists in mysql2 2 versions prior to 3.9.7, which originates from an arbitrary code injection via an incorrect cleanup of the timezone parameter in the readCodeFor function by calling the native...

PT-2024-6583

Name of the Vulnerable Software and Affected Versions: mysql2 versions prior to 3.9.7 Description: The issue is related to improper sanitization of the timezone parameter in the readCodeFor function, which can lead to Arbitrary Code Injection when calling a native MySQL Server date/time function...

@5minds/processcube_engine (>=15.0.0, <=17.0.0-renovate-fffeda-lowoukm9), @alexop/express-mysql-session (2.2.0) +143 more potentially affected by CVE-2024-21511 via mysql2 (>=3.0.0, <=3.9.6)

mysql2 NPM version =3.0.0, =15.0.0, =1.0.6-beta.0, =1.0.0, =15.0.0-alpha.2, =0.1.0, =0.1.0, =0.1.0, =1.0.75, =4.38.0, =4.0.1-alpha, =0.20.0, =0.52.0, =1.6.0, =2.9.24-alpha.2, =2.23.12 and more Source cves: CVE-2024-21511 Source advisory: SNYK:JS-MYSQL2-6670046...

Arbitrary Code Injection

Overview mysql2 is a mostly API compatible with mysqljs and supports majority of features. Affected versions of this package are vulnerable to Arbitrary Code Injection due to improper sanitization of the timezone parameter in the readCodeFor function by calling a native MySQL Server date/time...

Remote Code Execution (RCE)

mysql2 is vulnerable to Remote Code Execution RCE. The vulnerability is due to improper validation of supportBigNumbers and bigNumberStrings values within the readCodeFor function, which allows an attacker to execute arbitrary code...

The vulnerability of the readCodeFor function in the mysql2 library allows a hacker to execute arbitrary code.

The vulnerability of the readCodeFor function in the mysql2 database library is related to improper code generation. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Prototype Pollution

mysql2 is vulnerable to Prototype Pollution. The vulnerability is due to insecure object creation and improper user input sanitization which is passed through the parserFn method in both textparser.js and binaryparser.js...

Cache Poisoning

mysql2 is vulnerable to cache poisoning. The vulnerability is due to insufficient validation of user-supplied input within the keyFromFields function, allowing an attacker to inject a colon : character within a value of the attacker-crafted key, which results in cache poisoning...

CVE-2024-21509

A prototype pollution vulnerability was found in mysql2. Insecure results in object creation and improper user input sanitization can lead to prototype poisoning. Mitigation Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Securit...

mysql2 Remote Code Execution (RCE) via the readCodeFor function

Versions of the package mysql2 before 3.9.4 are vulnerable to Remote Code Execution RCE via the readCodeFor function due to improper validation of the supportBigNumbers and bigNumberStrings values...

@5minds/processcube_engine (>=15.0.0, <=17.0.0-renovate-fffeda-lowoukm9), @alexop/express-mysql-session (2.2.0) +140 more potentially affected by CVE-2024-21508 via mysql2 (>=3.0.0, <=3.9.3)

mysql2 NPM version =3.0.0, =15.0.0, =1.0.6-beta.0, =1.0.0, =15.0.0-alpha.2, =0.1.0, =0.1.0, =0.1.0, =1.0.75, =4.38.0, =4.0.1-alpha, =0.20.0, =0.52.0, =1.6.0, =2.9.24-alpha.2, =2.23.12 and more Source cves: CVE-2024-21508 Source advisory: OSV:GHSA-FPW7-J2HG-69V5...