-
Notifications
You must be signed in to change notification settings - Fork 8
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Update dependency mysql2 to v3 [SECURITY] #278
base: main
Are you sure you want to change the base?
Conversation
⚠ Artifact update problemRenovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is. ♻ Renovate will retry this branch, including artifacts, only when one of the following happens:
The artifact failure details are included below: File name: yarn.lock
|
|
New and removed dependencies detected. Learn more about Socket for GitHub ↗︎
🚮 Removed packages: npm/[email protected] |
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
4ec0816
to
ee889cf
Compare
|
This PR contains the following updates:
^2.1.0
->^3.0.0
GitHub Vulnerability Alerts
CVE-2024-21508
Versions of the package mysql2 before 3.9.4 are vulnerable to Remote Code Execution (RCE) via the
readCodeFor
function due to improper validation of thesupportBigNumbers
andbigNumberStrings
values.CVE-2024-21507
Versions of the package mysql2 before 3.9.3 are vulnerable to Improper Input Validation through the
keyFromFields
function, resulting in cache poisoning. An attacker can inject a colon:
character within a value of the attacker-crafted key.CVE-2024-21509
Versions of the package mysql2 before 3.9.4 are vulnerable to Prototype Poisoning due to insecure results object creation and improper user input sanitization passed through
parserFn
intext_parser.js
andbinary_parser.js
.CVE-2024-21511
Versions of the package mysql2 before 3.9.7 are vulnerable to Arbitrary Code Injection due to improper sanitization of the timezone parameter in the readCodeFor function by calling a native MySQL Server date/time function.
CVE-2024-21512
Versions of the package mysql2 before 3.9.8 are vulnerable to Prototype Pollution due to improper user input sanitization passed to fields and tables when using nestTables.
mysql2 cache poisoning vulnerability
CVE-2024-21507 / GHSA-mqr2-w7wj-jjgr
More information
Details
Versions of the package mysql2 before 3.9.3 are vulnerable to Improper Input Validation through the
keyFromFields
function, resulting in cache poisoning. An attacker can inject a colon:
character within a value of the attacker-crafted key.Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
References
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
mysql2 Remote Code Execution (RCE) via the readCodeFor function
CVE-2024-21508 / GHSA-fpw7-j2hg-69v5
More information
Details
Versions of the package mysql2 before 3.9.4 are vulnerable to Remote Code Execution (RCE) via the
readCodeFor
function due to improper validation of thesupportBigNumbers
andbigNumberStrings
values.Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
mysql2 vulnerable to Prototype Poisoning
CVE-2024-21509 / GHSA-49j4-86m8-q2jw
More information
Details
Versions of the package mysql2 before 3.9.4 are vulnerable to Prototype Poisoning due to insecure results object creation and improper user input sanitization passed through
parserFn
intext_parser.js
andbinary_parser.js
.Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
References
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
MySQL2 for Node Arbitrary Code Injection
CVE-2024-21511 / GHSA-4rch-2fh8-94vw
More information
Details
Versions of the package mysql2 before 3.9.7 are vulnerable to Arbitrary Code Injection due to improper sanitization of the timezone parameter in the readCodeFor function by calling a native MySQL Server date/time function.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
mysql2 vulnerable to Prototype Pollution
CVE-2024-21512 / GHSA-pmh2-wpjm-fj45
More information
Details
Versions of the package mysql2 before 3.9.8 are vulnerable to Prototype Pollution due to improper user input sanitization passed to fields and tables when using nestTables.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
References
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Release Notes
sidorares/node-mysql2 (mysql2)
v3.9.8
Compare Source
Bug Fixes
jonServerPublicKey
toonServerPublicKey
(#2699) (8b5f691)v3.9.7
Compare Source
Bug Fixes
v3.9.6
Compare Source
Bug Fixes
v3.9.5
Compare Source
Bug Fixes
v3.9.4
Compare Source
Bug Fixes
v3.9.3
Compare Source
Bug Fixes
v3.9.2
Compare Source
Bug Fixes
v3.9.1
Compare Source
Bug Fixes
v3.9.0
Compare Source
Features
execute
method (#2398) (baaa92a)v3.8.0
Compare Source
Features
Bug Fixes
for await
(#2389) (af47148)v3.7.1
Compare Source
Bug Fixes
v3.7.0
Compare Source
Features
v3.6.5
Compare Source
Bug Fixes
v3.6.4
Compare Source
Bug Fixes
ConnectionOptions
(#2288) (5cd7639)v3.6.3
Compare Source
Bug Fixes
v3.6.2
Compare Source
Bug Fixes
v3.6.1
Compare Source
Bug Fixes
v3.6.0
Compare Source
Features
infileStreamFactory
option (#2159) (5bed0f8)v3.5.2
Compare Source
Bug Fixes
v3.5.1
Compare Source
Bug Fixes
ResultSetHeader[]
toquery
andexecute
(f649486)v3.5.0
Compare Source
Features
v3.4.5
Compare Source
Bug Fixes
v3.4.4
Compare Source
Bug Fixes
ProcedureCallPacket
toexecute
overloads (3566ef7)ProcedureCallPacket
toquery
overloads (352c3bc)ProcedureCallPacket
to promise-basedexecute
overloads (8292416)ProcedureCallPacket
to promise-basedquery
overloads (0f31a41)ProcedureCallPacket
typings (09ad1d2)v3.4.3
Compare Source
Bug Fixes
v3.4.2
Compare Source
Bug Fixes
v3.4.1
Compare Source
Bug Fixes
createPool
uri overload (98623dd)PoolCluster
typings (3902ca6)PoolCluster
typings (7f38496)parserCache
inpromise.js
(7f35cf5)promise.js
(4ce2c70)Types
constant (86655ec)Charsets
constants (01f77a0)CharsetToEncoding
constants (609229a)parserCache
(891a523)Types
constant (04601dd)Charsets
constants (51c4196)v3.4.0
Compare Source
Features
v3.3.5
Compare Source
Bug Fixes
createPool
promise
asPromisePool
(#2060) (ff3c36c)v3.3.4
Compare Source
Bug Fixes
PromisePoolConnection
import name (76db54a)releaseConnection
types and promise (4aac9d6)v3.3.3
Compare Source
Bug Fixes
v3.3.2
Compare Source
Bug Fixes
v3.3.1
Compare Source
Bug Fixes
v3.3.0
Compare Source
Features
v3.2.4
Compare Source
Bug Fixes
v3.2.3
Compare Source
Bug Fixes
v3.2.2
Compare Source
Bug Fixes
ConnectionOptions
conflict betweenmysql
andmysql/promise
(#1955) (eca8bda)v3.2.1
Compare Source
Bug Fixes
v3.2.0
Compare Source
Features
v3.1.2
Compare Source
Bug Fixes
lru-cache
reset method to clear (114f266)v3.1.1
Compare Source
Bug Fixes
v3.1.0
Compare Source
Features
Bug Fixes
v3.0.1
Compare Source
Miscellaneous Chores
v3.0.0
Compare Source
lru-cache
dependency, allowing it do dedupe and be shared between mysql2 and named-placeholders - https://github.com/sidorares/node-mysql2/issues/1711, https://github.com/mysqljs/named-placeholders/pull/19chai
andmocha
moved to devDependencies #1774TCP_NODELAY
flag enabled, avoiding long connect timeout in some scenarios #1751Miscellaneous Chores
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.