Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
go-sql-driver/mysql
master @ 9d60a39
4
Fixes
50
CVEs
HIGH
Peak severity
Highlights
Auth Bypass: 2 prior fixes. Scrutinize any change in this area.
auth.go: most-fixed (1 issue). Treat as high-risk during review.
1 high-severity fix in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Flaws in client-side handshake transitions and authentication plugin packets (like caching_sha2 and native auth) can allow structural verification bypasses during the MySQL protocol login phase.
Auth Bypass: Mutating shared global TLS configurations rather than cloning them allows connection states to bleed across multiple DSNs, leading to hostname verification bypasses.
Broken Cryptography: Failing to default the TLS ServerName to the parsed DSN host address during custom configuration initialization leaves connections vulnerable to silent man-in-the-middle attacks.