CVE-2024-21508

CVSS V2 None CVSS V3 None

Description

Versions of the package mysql2 before 3.9.4 are vulnerable to Remote Code Execution (RCE) via the readCodeFor function due to improper validation of the supportBigNumbers and bigNumberStrings values.

Overview

CVE ID
CVE-2024-21508

Assigner
snyk

Vulnerability Status
PUBLISHED

Published Version
2024-04-11T05:00:00.748Z

Last Modified Date
2024-06-18T20:18:04.928Z

Weakness Enumerations

CWE	URL
CWE-94	http://cwe.mitre.org/data/definitions/94.html

References

Reference URL	Reference Tags
https://security.snyk.io/vuln/SNYK-JS-MYSQL2-6591085
https://blog.slonser.info/posts/mysql2-attacker-configuration/
https://github.com/sidorares/node-mysql2/blob/1609b5393516d72a4ae47196837317fbe75e0c13/lib/parsers/text_parser.js%23L14C10-L14C21
https://github.com/sidorares/node-mysql2/pull/2572
https://github.com/sidorares/node-mysql2/commit/74abf9ef94d76114d9a09415e28b496522a94805
https://github.com/sidorares/node-mysql2/releases/tag/v3.9.4

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2024-21508
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21508

History

Created	Old Value	New Value	Data Type	Notes
2024-06-26 15:16:50				Added to TrackCVE