Oracle MySQL Connectors vulnerabilities

15 CVEs affecting Oracle MySQL Connectors, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-21971, published 2023-04-18.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-3711, published 2021-08-24. Critical severity, CVSS 9.8. EPSS: 87.8% chance of exploitation in the next 30 days. In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this function twice. The first time, on entry, the…
CVE-2021-3449, published 2021-03-25. Medium severity, CVSS 5.9. EPSS: 63.5% chance of exploitation in the next 30 days. An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where…
CVE-2020-1967, published 2020-04-21. High severity, CVSS 7.5. EPSS: 53.3% chance of exploitation in the next 30 days. Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the…
CVE-2021-3712, published 2021-08-24. High severity, CVSS 7.4. EPSS: 50.4% chance of exploitation in the next 30 days. ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length. This contrasts with normal C…
CVE-2022-21824, published 2022-02-24. High severity, CVSS 8.2. EPSS: 21.5% chance of exploitation in the next 30 days. Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing a plain object…
CVE-2021-3450, published 2021-03-25. High severity, CVSS 7.4. EPSS: 18.3% chance of exploitation in the next 30 days. The X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a certificate chain. It is not set by default. Starting from OpenSSL version 1.1.1h a check to…
CVE-2021-44532, published 2022-02-24. Medium severity, CVSS 5.3. EPSS: 10.4% chance of exploitation in the next 30 days. Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names) to a string format. It uses this string to check peer certificates against hostnames when validating…
CVE-2021-44533, published 2022-02-24. Medium severity, CVSS 5.3. EPSS: 9.4% chance of exploitation in the next 30 days. Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished Names correctly. Attackers could craft certificate subjects containing a single-value Relative…
CVE-2021-44531, published 2022-02-24. High severity, CVSS 7.4. EPSS: 8.4% chance of exploitation in the next 30 days. Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-constrained intermediates. Node.js < 12.22.9,…
CVE-2021-2471, published 2021-10-20. Medium severity, CVSS 5.9. EPSS: 7.5% chance of exploitation in the next 30 days. Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.0.26 and prior. Difficult to exploit vulnerability allows high…

Latest

CVE-2023-21971, published 2023-04-18. Medium severity, CVSS 5.3. EPSS: 1.5% chance of exploitation in the next 30 days. Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.0.32 and prior. Difficult to exploit vulnerability allows high…
CVE-2022-21363, published 2022-01-19. Medium severity, CVSS 6.6. EPSS: 1.4% chance of exploitation in the next 30 days. Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.0.27 and prior. Difficult to exploit vulnerability allows high…