{"id":"GHSA-473q-m89c-ghf8","revision":null,"records":[{"revision":"e5fde8fb6c4a4d33ab3e51c2702c78df","observedAt":"2026-10-28T20:55:27.898+00:00","statement":{"source":"osv","id":"GHSA-473q-m89c-ghf8","aliases":[],"title":"MySqlConnector: Account password disclosed to a man-in-the-middle in zero-configuration TLS mode (clear-text password sent before certificate is verified)","description":"## Summary\n\nWith `SslMode` set to `VerifyCA` or `VerifyFull` with no configured CA certificate, an unvalidated TLS connection is treated as secure and a clear-text password can be sent before the certificate is checked. This can occur when relying on the password to validate a self-signed cert, e.g., MariaDB's [zero-configuration TLS](https://mariadb.com/docs/server/security/encryption/data-in-transit-encryption/zero-configuration-ssl).\n\n## Impact\n\nAn attacker who can deploy a man-in-the-middle MySQL proxy presenting any self-signed certificate can capture the plaintext database password of a client that:\n\n- uses `SslMode = VerifyCA` or `VerifyFull`, and\n- does not use the `SslCa` connection string option, and\n- uses a non-empty password.\n\nThe attacker completes the TLS handshake with its own cert, requests a clear-text password authentication scheme (`mysql_clear_password`, or forces the `caching_sha2_password`/`sha256_password` clear-text fallback), and receives the password before the fingerprint check rejects the connection, defeating the man-in-the-middle protection `VerifyFull` is expected to provide. \n\nNot affected: a configured CA (`SslCa`), CA-validated TLS, local connections (Unix socket / loopback), or empty passwords. Using `SslMode` set to `Preferred` or `Required` is out of scope (this is documented as not authenticating the server).\n\n## Workarounds\n\nProvide `SslCa` with `VerifyCA`/`VerifyFull`, use a local/Unix-socket connection, or avoid clear-text authentication.\n\n## References\n\n- https://mariadb.org/mission-impossible-zero-configuration-ssl/","state":0,"publishedAt":"2026-10-28T19:49:44+00:00","modifiedAt":"2026-10-28T20:00:04.871955+00:00","affected":[{"ecosystem":"NuGet","name":"MySqlConnector","ranges":[{"type":"ECOSYSTEM","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"2.6.1"}]}],"versions":["0.1.0","0.1.0-alpha01","0.1.0-alpha02","0.1.0-alpha03","0.1.0-alpha04","0.1.0-alpha05","0.1.0-alpha06","0.1.0-alpha07","0.1.0-alpha08","0.1.0-alpha09","0.1.0-alpha10","0.1.0-alpha11","0.1.0-alpha12","0.1.0-alpha13","0.1.0-alpha14","0.1.0-alpha15","0.1.0-alpha16","0.1.0-alpha17","0.1.0-alpha18","0.1.0-alpha19","0.1.0-alpha20","0.1.0-alpha21","0.1.0-alpha22","0.1.0-alpha23","0.1.0-alpha24","0.1.0-alpha25","0.1.0-alpha26","0.10.0","0.11.0","0.11.1","0.11.2","0.11.3","0.11.4","0.11.5","0.11.6","0.12.0","0.13.0","0.14.0","0.14.1","0.15.0","0.15.1","0.16.0","0.16.1","0.16.2","0.17.0","0.18.0","0.18.1","0.18.2","0.18.3","0.19.0","0.19.1","0.19.2","0.19.3","0.19.4","0.19.5","0.2.0","0.2.1","0.20.0","0.20.1","0.20.2","0.21.0","0.22.0","0.23.0","0.24.0","0.24.1","0.24.2","0.25.0","0.25.1","0.26.0","0.26.1","0.26.2","0.26.3","0.26.4","0.26.5","0.27.0","0.28.0","0.28.2","0.29.0","0.29.1","0.29.2","0.29.3","0.29.4","0.3.0","0.30.0","0.31.0","0.31.1","0.31.2","0.31.3","0.32.0","0.33.0","0.33.1","0.33.2","0.34.0","0.34.1","0.34.2","0.35.0","0.36.0","0.36.1","0.37.0","0.37.1","0.38.0","0.39.0","0.4.0","0.40.0","0.40.1","0.40.2","0.40.3","0.40.4","0.41.0","0.42.0","0.42.1","0.42.2","0.42.3","0.43.0","0.44.0","0.44.1","0.45.0","0.45.1","0.46.0","0.46.1","0.46.2","0.47.0","0.47.1","0.48.0","0.48.0-beta1","0.48.0-beta2","0.48.0-beta3","0.48.0-rc1","0.48.0-rc2","0.48.1","0.48.2","0.49.0","0.49.1","0.49.2","0.49.3","0.5.0","0.50.0","0.51.0","0.51.1","0.52.0","0.53.0","0.54.0","0.55.0","0.56.0","0.57.0","0.57.0-beta10","0.57.0-beta2","0.57.0-beta3","0.57.0-beta4","0.57.0-beta5","0.57.0-beta6","0.57.0-beta7","0.57.0-beta8","0.57.0-beta9","0.57.0-rc1","0.58.0","0.59.0","0.59.1","0.59.2","0.6.0","0.6.1","0.6.2","0.60.0","0.60.0-beta1","0.60.1","0.60.2","0.60.3","0.60.3-beta1","0.60.4","0.61.0","0.62.0","0.62.0-beta1","0.62.0-beta2","0.62.0-beta3","0.62.0-beta4","0.62.0-beta5","0.62.0-beta6","0.62.0-beta7","0.63.0","0.63.1","0.63.2","0.64.0","0.64.1","0.64.2","0.65.0","0.66.0","0.67.0","0.68.0","0.68.1","0.69.0","0.69.1","0.69.10","0.69.2","0.69.3","0.69.4","0.69.5","0.69.6","0.69.7","0.69.8","0.69.9","0.7.0","0.7.1","0.7.2","0.7.3","0.7.4","0.8.0","0.9.0","0.9.1","0.9.2","1.0.0","1.0.1","1.1.0","1.2.0","1.2.1","1.3.0","1.3.1","1.3.10","1.3.11","1.3.12","1.3.13","1.3.14","1.3.2","1.3.3","1.3.4","1.3.5","1.3.6","1.3.7","1.3.8","1.3.9","2.0.0","2.1.0","2.1.1","2.1.10","2.1.11","2.1.12","2.1.13","2.1.2","2.1.3","2.1.4","2.1.5","2.1.6","2.1.7","2.1.8","2.1.9","2.2.0","2.2.1","2.2.2","2.2.3","2.2.4","2.2.5","2.2.6","2.2.7","2.3.0","2.3.1","2.3.2","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7","2.4.0","2.5.0","2.6.0"],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/mysql-net/MySqlConnector/security/advisories/GHSA-473q-m89c-ghf8","https://github.com/mysql-net/MySqlConnector/commit/86503613fe3b72ae26c03dd1ea92f0e1e6e208f9","https://github.com/mysql-net/MySqlConnector","https://github.com/mysql-net/MySqlConnector/releases/tag/2.6.1"],"sourceUrl":"https://github.com/advisories/GHSA-473q-m89c-ghf8","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-473q-m89c-ghf8","identifiers":["GHSA-473q-m89c-ghf8"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-07T09:27:02.0881180+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-07T09:27:02.088118+00:00","lastSuccessAt":"2026-11-07T09:27:02.275552+00:00","error":null,"lastVerifiedAt":"2026-11-07T09:27:02.2755528+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-bb5c9d5a08063ef076042e33dd72a7d0ffa4c4487efdcf3106e29ba55ec2ad57-119922d4652e19b255c332c622ccf0862cc635682e2e6107e0a24821a354707e","complete":true,"records":420779,"lastAttemptAt":"2026-11-07T09:27:01.2826732+00:00","lastSuccessAt":"2026-11-07T09:27:01.2301134+00:00","error":null,"lastVerifiedAt":"2026-11-07T09:27:01.2826732+00:00","snapshotPublishedAt":"2026-11-07T09:18:48+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-b52a1e8adeec4da689c82b3880ed1f86","complete":true,"records":13631,"lastAttemptAt":"2026-11-07T09:38:22.8963621+00:00","lastSuccessAt":"2026-11-07T09:38:22.887+00:00","error":null,"lastVerifiedAt":"2026-11-07T09:38:22.887+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-07T09:27:02.0881180+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-07T09:27:02.088118+00:00","lastSuccessAt":"2026-11-07T09:27:02.2763671+00:00","error":null,"lastVerifiedAt":"2026-11-07T09:27:02.2763676+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-1262a9fa83024e28a1560dfc0c9cdf3c","complete":true,"records":13645,"lastAttemptAt":"2026-11-07T09:27:03.0678524+00:00","lastSuccessAt":"2026-11-07T06:27:08.533+00:00","error":null,"lastVerifiedAt":"2026-11-07T06:27:08.533+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-0eb4d6dde62dffacd040ad992d4fd5a65cd7d0dc5f5f4cfa8b41967fc6f9ca5f","complete":true,"records":9914,"lastAttemptAt":"2026-11-07T09:27:01.6721049+00:00","lastSuccessAt":"2026-11-06T20:10:36.6450506+00:00","error":null,"lastVerifiedAt":"2026-11-07T09:27:01.6721049+00:00","snapshotPublishedAt":"2026-11-06T20:02:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-07T09:27:01.4581125+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":null,"lastVerifiedAt":"2026-11-07T09:27:01.4581125+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-335633e78a15c9cde10a6025895b5617717087fb945489ae7e15d377bacf34a9","complete":true,"records":3055,"lastAttemptAt":"2026-11-07T09:27:02.0484184+00:00","lastSuccessAt":"2026-11-06T16:03:00.7615789+00:00","error":null,"lastVerifiedAt":"2026-11-07T09:27:02.0484184+00:00","snapshotPublishedAt":"2026-11-06T16:02:48+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-a0b728bc1c5526b5429930c00621636eba8655069c176697c3080f8377619ad7","complete":true,"records":231291,"lastAttemptAt":"2026-11-07T09:27:01.5654151+00:00","lastSuccessAt":"2026-11-07T00:28:51.1983528+00:00","error":null,"lastVerifiedAt":"2026-11-07T09:27:01.5654151+00:00","snapshotPublishedAt":"2026-11-06T23:33:08+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}