CVE-2022-45347: Incomplete Cleanup

December 22, 2022 (updated December 29, 2022)

Apache ShardingSphere-Proxy prior to 5.3.0 when using MySQL as database backend didn’t cleanup the database session completely after client authentication failed, which allowed an attacker to execute normal commands by constructing a special MySQL client. This vulnerability has been fixed in Apache ShardingSphere 5.3.0.

References

lists.apache.org/thread/l5rz7j4rg10o7ywtgknh2f5hxnv6yw3l
nvd.nist.gov/vuln/detail/CVE-2022-45347

Code Behaviors & Features

Detect and mitigate CVE-2022-45347 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →