[manjaro-security] [ASA-201902-21] python-mysql-connector: authentication bypass
foxboron at archlinux.org
Mon Feb 25 09:54:55 CET 2019
Arch Linux Security Advisory ASA-201902-21
Date : 2019-02-17
CVE-ID : CVE-2019-2435
Package : python-mysql-connector
Type : authentication bypass
Remote : Yes
Link : https://security.archlinux.org/AVG-898
The package python-mysql-connector before version 8.0.15-1 is
vulnerable to authentication bypass.
Upgrade to 8.0.15-1.
# pacman -Syu "python-mysql-connector>=8.0.15-1"
The problem has been fixed upstream in version 8.0.15.
A flaw was found in mysql-connector prior to version 8.0.13.
Unauthenticated attacker with network access via TLS could compromise
MySQL Connectors. Successful attacks require human interaction from a
person other than the attacker and can result in unauthorized creation,
deletion or modification access to critical data.
An unauthenticated attacker could serve malicious TLS traffic and
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 833 bytes
Desc: not available
More information about the manjaro-security