critical9.8
CVE-2022-3023
TiDB vulnerable to Use of Externally-Controlled Format String
Impact
TiDB server (importer CLI tool) prior to version 6.4.0 & 6.1.3 is vulnerable to data source name injection. The database name for generating and inserting data into a database does not properly sanitize user input which can lead to arbitrary file reads."
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/pingcap/tidb | <= 6.1.2 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Pingcap | Tidb | before 6.4.0 from 6.1.0 before 6.1.3 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/pingcap/tidb/commit/d0376379d615cc8f263a0b17c031ce403c8dcbfb
- https://huntr.dev/bounties/120f1346-e958-49d0-b66c-0f889a469540
- https://github.com/advisories/GHSA-7fxj-fr3v-r9gj
- https://nvd.nist.gov/vuln/detail/CVE-2022-3023
- https://advisory.dw1.io/45