GitHub Advisoryadvisory · Go

GHSA-7fxj-fr3v-r9gj TiDB vulnerable to Use of Externally-Controlled Format String

CRITICAL Published 2022-11-04 Modified 2022-11-24 Official page ↗
Aliases
CVE-2022-3023
Ecosystem
Go
Packages
github.com/pingcap/tidb
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-134
Reviewed
2022-11-04

Affected packages

• Go github.com/pingcap/tidb: <= 6.1.2 (no fix yet) • Go github.com/pingcap/tidb: >= 6.2.0, <= 6.4.0-alpha1 (no fix yet)

Description

TiDB server (importer CLI tool) prior to version 6.4.0 & 6.1.3 is vulnerable to data source name injection. The database name for generating and inserting data into a database does not properly sanitize user input which can lead to arbitrary file reads."

Related

Alias · CVE (1)

  • CVE-2022-3023 Use of Externally-Controlled Format String in GitHub repository pingcap/tidb prior to 6.4.0, 6.1.3. vulnerability

Weakness · CWE (1)

  • CWE-134 Use of Externally-Controlled Format String weakness

References