https://bugzilla.redhat.com/show_bug.cgi?id=1444759
Tomas Hoger <thoger(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Fixed In Version| |mysql-connector-java 5.1.41
Summary|CVE-2017-3523 |CVE-2017-3523
|mysql-connector-java: |mysql-connector-java:
|Connector/J unspecified |Improper automatic
|vulnerability (CPU Apr |deserialization of binary
|2017) |data (CPU Apr 2017)
--- Comment #2 from Tomas Hoger <thoger(a)redhat.com> ---
Further details are now available via an advisory from the original issue
reporter:
https://www.computest.nl/advisories/CT-2017-0425_MySQL-Connector-J.txt
The advisory describes that the MySQL Connector/J can perform Java object
deserialization even when autoDeserialize flag is set to false. In certain
cases, a malicious MySQL server could use this flaw to execute arbitrary code
on the client using the Connector/J.
Upstream commit:
https://github.com/mysql/mysql-connector-j/commit/6189e718de5b6c6115aee45...
There does not seem to be any mention of the issue in the 5.1.41 release notes:
https://dev.mysql.com/doc/relnotes/connector-j/5.1/en/news-5-1-41.html
--
You are receiving this mail because:
You are on the CC list for the bug.