Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

mariadb-corporation/mariadb-connector-j

              main @ c9377bc
            

Fixes

CVEs

HIGH

Peak severity

42.9%

Coverage

Highlights

Auth Bypass: 2 prior fixes. Scrutinize any change in this area.

src/main/java/org/mariadb/jdbc/client/impl/StandardClient.java: most-fixed (2 issues). Treat as high-risk during review.

4 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: The client failed to properly enforce secure transport or certificate validation before initializing authentication plugins, potentially exposing sensitive credentials to a rogue or MITM server. Connection redirects without active SSL verification also compounded this risk.

Arbitrary File Read: A malicious MariaDB server could force the client driver to upload local client files even when the 'allowLocalInfile' safety configuration option was explicitly set to false, resulting in arbitrary local file read capabilities.

Cleartext Transmission of Sensitive Information: The PAM (dialog) authentication plugin could transmit credentials in cleartext over unencrypted TCP connections without confirming that the underlying transport was fully secure (SSL/TLS or a local Unix socket).