Vulnerability Description
Trilogy is a client library for MySQL. When authenticating, a malicious server could return a specially crafted authentication packet, causing the client to read and return up to 12 bytes of data from an uninitialized variable in stack memory. Users of the trilogy gem should upgrade to version 2.1.1 This issue can be avoided by only connecting to trusted servers.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Trilogy Project | Trilogy | < 2.1.1 |
Related Weaknesses (CWE)
References
- https://github.com/github/trilogy/commit/6bed62789eaf119902b0fe247d2a91d56c31a96PatchThird Party Advisory
- https://github.com/github/trilogy/security/advisories/GHSA-5g4r-2qhx-vqfmThird Party Advisory
- https://github.com/github/trilogy/commit/6bed62789eaf119902b0fe247d2a91d56c31a96PatchThird Party Advisory
- https://github.com/github/trilogy/security/advisories/GHSA-5g4r-2qhx-vqfmThird Party Advisory
FAQ
What is CVE-2022-31026?
CVE-2022-31026 is a vulnerability with a CVSS score of 5.9 (MEDIUM). Trilogy is a client library for MySQL. When authenticating, a malicious server could return a specially crafted authentication packet, causing the client to read and return up to 12 bytes of data from...
How severe is CVE-2022-31026?
CVE-2022-31026 has been rated MEDIUM with a CVSS base score of 5.9/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-31026?
Check the references section above for vendor advisories and patch information. Affected products include: Trilogy Project Trilogy.