PT-2026-85144

Summary A rogue MySQL server or MITM can force mysql2 to send credentials in plaintext by requesting an auth switch to mysql clear password. The driver complies without verifying that TLS is active. Details mysql clear password is registered as a default standard plugin in lib/commands/auth...