Oracle MySQL Connectors up to 5.3.13/8.0.17 OpenSSL cryptographic issue

Summaryinfo

A vulnerability described as critical has been identified in Oracle MySQL Connectors up to 5.3.13/8.0.17. This impacts an unknown function of the component OpenSSL. Executing a manipulation can lead to cryptographic issue. This vulnerability is registered as CVE-2019-1543. It is possible to launch the attack remotely. No exploit is available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability has been found in Oracle MySQL Connectors up to 5.3.13/8.0.17 (Database Software) and classified as critical. This vulnerability affects an unknown code block of the component OpenSSL. The manipulation with an unknown input leads to a cryptographic issue vulnerability. The CWE definition for the vulnerability is CWE-310. As an impact it is known to affect confidentiality, and integrity.

The weakness was published 10/16/2019 as Oracle Critical Patch Update Advisory - October 2019 as confirmed advisory (Website). The advisory is shared for download at oracle.com. This vulnerability was named CVE-2019-1543. The exploitation appears to be difficult. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1600.

The vulnerability scanner Nessus provides a plugin with the ID 211827 (Oracle Linux 9 : edk2 (ELSA-2024-12842)), which helps to determine the existence of the flaw in a target environment. The commercial vulnerability scanner Qualys is able to test this issue with plugin 172247 (OpenSUSE Security Update for openssl-1_1 (openSUSE-SU-2019:1147-1)).

Upgrading eliminates this vulnerability. A possible mitigation has been published immediately after the disclosure of the vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (211827). Similar entries are available at VDB-131391, VDB-138172, VDB-143620 and VDB-143661. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Database Software

Vendor

• Oracle

Name

• MySQL Connectors

Version

• 5.3.0
• 5.3.1
• 5.3.2
• 5.3.3
• 5.3.4
• 5.3.5
• 5.3.6
• 5.3.7
• 5.3.8
• 5.3.9
• 5.3.10
• 5.3.11
• 5.3.12
• 5.3.13
• 8.0.0
• 8.0.1
• 8.0.2
• 8.0.3
• 8.0.4
• 8.0.5
• 8.0.6
• 8.0.7
• 8.0.8
• 8.0.9
• 8.0.10
• 8.0.11
• 8.0.12
• 8.0.13
• 8.0.14
• 8.0.15
• 8.0.16
• 8.0.17

License

• commercial

Website

• Vendor: https://www.oracle.com

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion