Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

mysql/mysql-connector-j

              release/9.x @ 1363d9b
            

Fixes

CVEs

HIGH

Peak severity

66.7%

Coverage

Highlights

Auth Bypass: 1 prior fix. Scrutinize any change in this area.

src/main/protocol-impl/java/com/mysql/cj/protocol/a/authentication/AuthenticationKerberosClient.java: most-fixed (1 issue). Treat as high-risk during review.

2 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Insecure Deserialization: The automatic deserialization of binary large objects (BLOBs) using standard ObjectInputStream allowed remote code execution via malicious database payloads. While the 'autoDeserialize' feature was removed in this component, developers must ensure no alternative result-processing code paths attempt to deserialize Java objects from untrusted SQL fields.

Auth Bypass: Weak validation of JAAS configurations allowed arbitrary login module injection during Kerberos and LDAP SASL client authentications. Developers must explicitly restrict allowed login modules to Krb5LoginModule to prevent attackers from substituting arbitrary execution targets.

Weak TLS Configuration: Allowing weak, legacy cipher suites (such as 3DES, DH, and short-tag CCM) exposes client-server communications to potential interception or downgrade attacks. Maintaining strict classification of deprecated and unacceptable ciphers in the driver configuration is critical.