medium5.5
CVE-2019-14939
MySQL for Node.js Unsafe Options
Impact
An issue was discovered in the mysql (aka mysqljs) module 2.17.1 for Node.js. `The LOAD DATA LOCAL INFILE` option is open by default.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | mysql | = 2.17.1 | 2.18.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mysql Project | Mysql | Version 2.17.1 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/mysqljs/mysql/issues/2257
- https://github.com/advisories/GHSA-f982-mxwc-3mrx
- https://nvd.nist.gov/vuln/detail/CVE-2019-14939
- https://github.com/mysqljs/mysql/issues/2471
- https://github.com/mysqljs/mysql/commit/337e87ae5fcea3667864197c65dc758517fcde06
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=934712>
- https://web.archive.org/web/20190812004403/https://github.com/mysqljs/mysql/issues/2257