{"id":"GHSA-5f7m-mmpc-qhh4","aliases":[],"url":"https://o3.security/vulnerability/GHSA-5f7m-mmpc-qhh4","summary":"mysql Node.JS Module Vulnerable to Remote Memory Exposure","details":"Versions of `mysql` before 2.14.0 are vulnerable to remove memory exposure.\n\nAffected versions of `mysql` package allocate and send an uninitialized memory over the network when a number is provided as a password.\n\nOnly `mysql` running on Node.js versions below 6.0.0 are affected due to a throw added in newer node.js versions.\n\nProof of Concept:\n\n```\nrequire('mysql').createConnection({\n  host: 'localhost',\n  user: 'user',\n  password : USERPROVIDEDINPUT,  // number\n  database : 'my_db'\n}).connect();\n```\n\n\n\n## Recommendation\n\nUpdate to version 2.14.0 or later.","published":"2019-05-23T09:27:00Z","modified":"2022-08-03T20:30:06Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"mysql","fixedVersion":"2.14.0"}],"fix":{"url":"https://github.com/mysqljs/mysql/commit/192fe45593ba5768534afb6f2154432ca67a5002","label":"mysqljs/mysql@192fe45"},"references":[{"type":"WEB","url":"https://github.com/mysqljs/mysql/commit/192fe45593ba5768534afb6f2154432ca67a5002"},{"type":"WEB","url":"https://github.com/mysqljs/mysql/commit/310c6a7d1b2e14b63b572dbfbfa10128f20c6d52"},{"type":"PACKAGE","url":"https://github.com/mysqljs/mysql"},{"type":"WEB","url":"https://www.npmjs.com/advisories/602"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2022-08-03T20:30:06Z"}}