Detections
Analytics

openSUSE 15 Security Update : python-mysql-connector-python (openSUSE-SU-2024:0351-1)

high Nessus Plugin ID 210463

Language:

Synopsis

The remote openSUSE host is missing a security update.

Description

The remote openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2024:0351-1 advisory.

 - Update to 9.1.0 (boo#1231740, CVE-2024-21272)
 - WL#16452: Bundle all installable authentication plugins when building the C-extension
 - WL#16444: Drop build support for DEB packages
 - WL#16442: Upgrade gssapi version to 1.8.3
 - WL#16411: Improve wheel metadata information for Classic and XDevAPI connectors
 - WL#16341: OpenID Connect (Oauth2 - JWT) Authentication Support
 - WL#16307: Remove Python 3.8 support
 - WL#16306: Add support for Python 3.13
 - BUG#37055435: Connection fails during the TLS negotiation when specifying TLSv1.3 ciphers
 - BUG#37013057: mysql-connector-python Parameterized query SQL injection
 - BUG#36765200: python mysql connector 8.3.0 raise %-.100s:%u when input a wrong host
 - BUG#36577957: Update charset/collation description indicate this is 16 bits
 - 9.0.0:
 - WL#16350: Update dnspython version
 - WL#16318: Deprecate Cursors Prepared Raw and Named Tuple
 - WL#16284: Update the Python Protobuf version
 - WL#16283: Remove OpenTelemetry Bundled Installation
 - BUG#36664998: Packets out of order error is raised while changing user in aio
 - BUG#36611371: Update dnspython required versions to allow latest 2.6.1
 - BUG#36570707: Collation set on connect using C-Extension is ignored
 - BUG#36476195: Incorrect escaping in pure Python mode if sql_mode includes NO_BACKSLASH_ESCAPES
 - BUG#36289767: MySQLCursorBufferedRaw does not skip conversion
 - 8.4.0
 - WL#16203: GPL License Exception Update
 - WL#16173: Update allowed cipher and cipher-suite lists
 - WL#16164: Implement support for new vector data type
 - WL#16127: Remove the FIDO authentication mechanism
 - WL#16053: Support GSSAPI/Kerberos authentication on Windows using authentication_ldap_sasl_client plug-in for C-extension
 - BUG#36227964: Improve OpenTelemetry span coverage
 - BUG#36167880: Massive memory leak mysqlx native Protobuf adding to collection
 - 8.3.0
 - WL#16015: Remove use of removed COM_ commands
 - WL#15985: Support GSSAPI/Kerberos authentication on Windows using authentication_ldap_sasl_client plug-in for Pure Python
 - WL#15983: Stop using mysql_ssl_set api
 - WL#15982: Remove use of mysql_shutdown
 - WL#15950: Support query parameters for prepared statements
 - WL#15942: Improve type hints and standardize byte type handling
 - WL#15836: Split mysql and mysqlx into different packages
 - WL#15523: Support Python DB API asynchronous execution
 - BUG#35912790: Binary strings are converted when using prepared statements
 - BUG#35832148: Fix Django timezone.utc deprecation warning
 - BUG#35710145: Bad MySQLCursor.statement and result when query text contains code comments
 - BUG#21390859: STATEMENTS GET OUT OF SYNCH WITH RESULT SETS

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected python3-mysql-connector-python package.

See Also

https://bugzilla.suse.com/1231740

http://www.nessus.org/u?9dcdd012

https://www.suse.com/security/cve/CVE-2024-21272

Plugin Details

Severity: High

ID: 210463

File Name: openSUSE-2024-0351-1.nasl

Version: 1.1

Type: local

Agent: unix

Published: 11/7/2024

Updated: 11/7/2024

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.4

CVSS v2

Risk Factor: High

Base Score: 7.1

Temporal Score: 5.3

Vector: CVSS2#AV:N/AC:H/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2024-21272

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:novell:opensuse:python3-mysql-connector-python, cpe:/o:novell:opensuse:15.5

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 11/6/2024

Vulnerability Publication Date: 10/15/2024

Reference Information

CVE: CVE-2024-21272