MariaDB MaxScale up to 2.5.27/6.4.8/22.08.7/23.02.2 Command Line maxscale.cnf.d missing encryption

Summaryinfo

A vulnerability, which was classified as problematic, has been found in MariaDB MaxScale up to 2.5.27/6.4.8/22.08.7/23.02.2. This affects an unknown function in the library /var/lib/maxscale/maxscale.cnf.d of the component Command Line. This manipulation causes missing encryption. This vulnerability is handled as CVE-2023-40354. There is not any exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability has been found in MariaDB MaxScale up to 2.5.27/6.4.8/22.08.7/23.02.2 (Database Software) and classified as problematic. Affected by this vulnerability is an unknown functionality in the library /var/lib/maxscale/maxscale.cnf.d of the component Command Line. The manipulation with an unknown input leads to a missing encryption vulnerability. The CWE definition for the vulnerability is CWE-311. The product does not encrypt sensitive or critical information before storage or transmission. As an impact it is known to affect confidentiality. The summary by CVE is:

An issue was discovered in MariaDB MaxScale before 23.02.3. A user enters an encrypted password on a "maxctrl create service" command line, but this password is then stored in cleartext in the resulting .cnf file under /var/lib/maxscale/maxscale.cnf.d. The fixed versions are 2.5.28, 6.4.9, 22.08.8, and 23.02.3.

The weakness was released 08/14/2023. It is possible to read the advisory at jira.mariadb.org. This vulnerability is known as CVE-2023-40354 since 08/14/2023. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1600 according to MITRE ATT&CK.

Upgrading to version 2.5.28, 6.4.9, 22.08.8 or 23.02.3 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2023-44925). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Database Software

Vendor

• MariaDB

Name

• MaxScale

Version

• 2.5.0
• 2.5.1
• 2.5.2
• 2.5.3
• 2.5.4
• 2.5.5
• 2.5.6
• 2.5.7
• 2.5.8
• 2.5.9
• 2.5.10
• 2.5.11
• 2.5.12
• 2.5.13
• 2.5.14
• 2.5.15
• 2.5.16
• 2.5.17
• 2.5.18
• 2.5.19
• 2.5.20
• 2.5.21
• 2.5.22
• 2.5.23
• 2.5.24
• 2.5.25
• 2.5.26
• 2.5.27
• 6.4.0
• 6.4.1
• 6.4.2
• 6.4.3
• 6.4.4
• 6.4.5
• 6.4.6
• 6.4.7
• 6.4.8
• 22.08.0
• 22.08.1
• 22.08.2
• 22.08.3
• 22.08.4
• 22.08.5
• 22.08.6
• 22.08.7
• 23.02.0
• 23.02.1
• 23.02.2

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion