CVE-2023-2283 in MySQL Workbench

Summary

A vulnerability was found in libssh, where the authentication check of the connecting client can be bypassed in the`pki_verify_data_signature` function in memory allocation problems. This issue may happen if there is insufficient memory or the memory usage is limited. The problem is caused by the return value `rc,` which is initialized to SSH_ERROR and later rewritten to save the return value of the function call `pki_key_check_hash_compatible.` The value of the variable is not changed between this point and the cryptographic verification. Therefore any error between them calls `goto error` returning SSH_OK.

Be aware that VulDB is the high quality source for vulnerability data.

Reservation

04/25/2023

Disclosure

05/26/2023

Status

Confirmed

Entries

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerability	CWE	Exp	Cou	CVE
251272	Oracle MySQL Workbench improper authentication	287	Not defined	Official fix	CVE-2023-2283
251262	Oracle MySQL Cluster improper authentication	287	Not defined	Official fix	CVE-2023-2283
251045	Oracle Communications Cloud Native Core Network Repository Function Install/Upgrade improper authentication	287	Not defined	Official fix	CVE-2023-2283
251044	Oracle Communications Cloud Native Core Console Configuration improper authentication	287	Not defined	Official fix	CVE-2023-2283
242546	Oracle Communications Network Analytics Data Director Platform improper authentication	287	Not defined	Official fix	CVE-2023-2283
242531	Oracle Communications Cloud Native Core Binding Support Function Install/Upgrade improper authentication	287	Not defined	Official fix	CVE-2023-2283
228182	libssh pki_verify_data_signature access control	284	Not defined	Not defined	CVE-2023-2283

Sources

• MITRE
• NVD
• CVE Details