ProxySQL uninitialized heap read in MySQL compressed packets can leak queries and credentials
Earlier database requests and login details can leak from this database proxy.
Summary
ProxySQL reads uninitialized heap memory while decompressing MySQL packets, so an authenticated client can get stale queries, result data, or credentials from the backend. Versions before 3.0.10, 3.1.10, and 4.0.10 are affected.
Affected when
- An authenticated MySQL client that negotiates compression
- ProxySQL before 3.0.10, 3.1.10, or 4.0.10
What to do
Update to the fixed version for your release line: 3.0.10, 3.1.10, or 4.0.10.
Update to at least the version for your product:
- ProxySQL 3.0 3.0.10 or later
- ProxySQL 3.1 3.1.10 or later
- ProxySQL 4.0 4.0.10 or later
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen