mariadb connector/node.js Cleartext Transmission Vulnerability Alert
- Severity
- HIGH
- Affected component
- mariadb connector/node.js (npm)
- Patched version
- 3.5.3
An early warning has been issued for a vulnerability in the mariadb connector/node.js package. This vulnerability may result in the transmission of sensitive information and credentials in cleartext when using PAM authentication over an insecure connection.
What happened
The mariadb connector/node.js package is reportedly affected by a vulnerability that causes it to transmit sensitive information and credentials in cleartext when using PAM authentication over an insecure connection. This can lead to the disclosure of user passwords to an on-path or hostile server. The vulnerability is under investigation and has not yet been exploited in the wild.
Affected versions include <3.2.4, <3.3.3, <3.4.6, and <3.5.3. The recommended patched versions are 3.2.4, 3.3.3, 3.4.6, and 3.5.3 respectively. Users of these versions should upgrade to the corresponding patched version to mitigate the risk.
What to do about it
- Upgrade your mariadb connector/node.js package to the corresponding patched version: 3.2.4, 3.3.3, 3.4.6, or 3.5.3.
- Ensure that PAM authentication is not used over insecure connections until the upgrade is complete.
- Monitor the primary sources for updates on the vulnerability and any additional mitigation steps that may be recommended.
How 0Day would have caught this
mariadb connector/node.js is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using a version of mariadb connector/node.js that is less than 3.2.4, 3.3.3, 3.4.6, or 3.5.3.
What should I do right now?
Upgrade to the corresponding patched version: 3.2.4, 3.3.3, 3.4.6, or 3.5.3.
Is this vulnerability being exploited in the wild?
There is no evidence that this vulnerability has been exploited in the wild at this time.