Vulnerability · Published Apr 14, 2023 · Assigned by GitHub_M
CVE-2023-29194vitess allows users to create keyspaces that can deny access to already existing keyspaces
Medium 4.1
In plain English
A medium-severity improper input validation in vitess from vitessio. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Vitess is a database clustering system for horizontal scaling of MySQL. Users can either intentionally or inadvertently create a keyspace containing `/` characters such that from that point on, anyone who tries to view keyspaces from VTAdmin will receive an error. Trying to list all the keyspaces using `vtctldclient GetKeyspaces` will also return an error. Note that all other keyspaces can still be administered using the CLI (vtctldclient). This issue is fixed in version 16.0.1. As a workaround, delete the offending keyspace using a CLI client (vtctldclient).
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | vitess.io/vitess | 0.16.1 | GHSA-735r-hv67-g38f |
| Go | vitess.io/vitess | 0.16.1 | GO-2023-1717 |
Affected products (as reported)
Weakness: CWE-20, CWE-703 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L
References
- https://github.com/vitessio/vitess/security/advisories/GHSA-735r-hv67-g38f x_refsource_CONFIRM
- https://github.com/vitessio/vitess/commit/adf10196760ad0b3991a7aa7a8580a544e6ddf88 x_refsource_MISC
- https://github.com/vitessio/vitess/commits/v0.16.1/ x_refsource_MISC