Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

openSUSE-SU-2024:0351-1

Опубликовано: 06 нояб. 2024
Источник: suse-cvrf

Описание

Security update for python-mysql-connector-python

This update for python-mysql-connector-python fixes the following issues:

  • Update to 9.1.0 (boo#1231740, CVE-2024-21272)
    • WL#16452: Bundle all installable authentication plugins when building the C-extension
    • WL#16444: Drop build support for DEB packages
    • WL#16442: Upgrade gssapi version to 1.8.3
    • WL#16411: Improve wheel metadata information for Classic and XDevAPI connectors
    • WL#16341: OpenID Connect (Oauth2 - JWT) Authentication Support
    • WL#16307: Remove Python 3.8 support
    • WL#16306: Add support for Python 3.13
    • BUG#37055435: Connection fails during the TLS negotiation when specifying TLSv1.3 ciphers
    • BUG#37013057: mysql-connector-python Parameterized query SQL injection
    • BUG#36765200: python mysql connector 8.3.0 raise %-.100s:%u when input a wrong host
    • BUG#36577957: Update charset/collation description indicate this is 16 bits
  • 9.0.0:
    • WL#16350: Update dnspython version
    • WL#16318: Deprecate Cursors Prepared Raw and Named Tuple
    • WL#16284: Update the Python Protobuf version
    • WL#16283: Remove OpenTelemetry Bundled Installation
    • BUG#36664998: Packets out of order error is raised while changing user in aio
    • BUG#36611371: Update dnspython required versions to allow latest 2.6.1
    • BUG#36570707: Collation set on connect using C-Extension is ignored
    • BUG#36476195: Incorrect escaping in pure Python mode if sql_mode includes NO_BACKSLASH_ESCAPES
    • BUG#36289767: MySQLCursorBufferedRaw does not skip conversion
  • 8.4.0
    • WL#16203: GPL License Exception Update
    • WL#16173: Update allowed cipher and cipher-suite lists
    • WL#16164: Implement support for new vector data type
    • WL#16127: Remove the FIDO authentication mechanism
    • WL#16053: Support GSSAPI/Kerberos authentication on Windows using authentication_ldap_sasl_client plug-in for C-extension
    • BUG#36227964: Improve OpenTelemetry span coverage
    • BUG#36167880: Massive memory leak mysqlx native Protobuf adding to collection
  • 8.3.0
    • WL#16015: Remove use of removed COM_ commands
    • WL#15985: Support GSSAPI/Kerberos authentication on Windows using authentication_ldap_sasl_client plug-in for Pure Python
    • WL#15983: Stop using mysql_ssl_set api
    • WL#15982: Remove use of mysql_shutdown
    • WL#15950: Support query parameters for prepared statements
    • WL#15942: Improve type hints and standardize byte type handling
    • WL#15836: Split mysql and mysqlx into different packages
    • WL#15523: Support Python DB API asynchronous execution
    • BUG#35912790: Binary strings are converted when using prepared statements
    • BUG#35832148: Fix Django timezone.utc deprecation warning
    • BUG#35710145: Bad MySQLCursor.statement and result when query text contains code comments
    • BUG#21390859: STATEMENTS GET OUT OF SYNCH WITH RESULT SETS

Список пакетов

SUSE Package Hub 15 SP5
python3-mysql-connector-python-9.1.0-bp155.3.3.1
openSUSE Leap 15.5
python3-mysql-connector-python-9.1.0-bp155.3.3.1

Ссылки

Описание

Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Python). Supported versions that are affected are 9.0.0 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

Затронутые продукты
SUSE Package Hub 15 SP5:python3-mysql-connector-python-9.1.0-bp155.3.3.1
openSUSE Leap 15.5:python3-mysql-connector-python-9.1.0-bp155.3.3.1
Ссылки