Описание
aiomysql is a library for accessing a MySQL database from the asyncio. Prior to version 0.3.0, the client-side settings are not checked before sending local files to MySQL server, which allows obtaining arbitrary files from the client using a rogue server. It is possible to create a rogue MySQL server that emulates authorization, ignores client flags and requests arbitrary files from the client by sending a LOAD_LOCAL instruction packet. This issue has been patched in version 0.3.0.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| aiomysql | fixed | 0.3.2-1 | package | |
| aiomysql | no-dsa | trixie | package | |
| aiomysql | no-dsa | bookworm | package | |
| aiomysql | postponed | bullseye | package |
Примечания
https://github.com/aio-libs/aiomysql/security/advisories/GHSA-r397-ff8c-wv2g
https://github.com/aio-libs/aiomysql/pull/1044
Fixed by: https://github.com/aio-libs/aiomysql/commit/32c4520dae3711367ded74a4726dcb8bb8919538 (v0.3.2)
EPSS
Связанные уязвимости
aiomysql is a library for accessing a MySQL database from the asyncio. Prior to version 0.3.0, the client-side settings are not checked before sending local files to MySQL server, which allows obtaining arbitrary files from the client using a rogue server. It is possible to create a rogue MySQL server that emulates authorization, ignores client flags and requests arbitrary files from the client by sending a LOAD_LOCAL instruction packet. This issue has been patched in version 0.3.0.
aiomysql is a library for accessing a MySQL database from the asyncio. Prior to version 0.3.0, the client-side settings are not checked before sending local files to MySQL server, which allows obtaining arbitrary files from the client using a rogue server. It is possible to create a rogue MySQL server that emulates authorization, ignores client flags and requests arbitrary files from the client by sending a LOAD_LOCAL instruction packet. This issue has been patched in version 0.3.0.
aiomysql allows arbitrary access to client files through vulnerability of a malicious MySQL server
Уязвимость библиотеки доступа к базе данных MySQL aiomysql, связанная с внешним контролем имени файла или пути, позволяющая нарушителю вызвать отказ в обслуживании
EPSS