| Package | Affected versions | Patched versions |
|---|---|---|
| org.mariadb.jdbc:mariadb-java-client | ≥ 3.0.0, < 3.3.7≥ 3.4.0, < 3.4.5≥ 3.5.0, < 3.5.11 | 3.3.73.4.53.5.11 |
XAResource.recover() in MariaDB Connector/J trusted the gtrid_length and
bqual_length columns returned by XA RECOVER to allocate and split each Xid.
MariaDbPoolConnection and MariaDbPoolPinnedConnection built each Xid of
the recovery list by allocating new byte[gtrid_length] and
new byte[bqual_length] and copying from the data column, without validating
the lengths against the XA specification bounds (Xid.MAXGTRIDSIZE,
Xid.MAXBQUALSIZE) or the actual payload. Negative or oversized lengths, or
lengths that do not fit the data, ended in large allocations or unchecked
exceptions (NegativeArraySizeException, ArrayIndexOutOfBoundsException)
during recovery.
The fix validates the lengths before any allocation or copy and reports an
invalid row as an XAException (XAER_RMFAIL).
Availability only, and limited to applications running XA recovery: a malicious or compromised server, or a MitM, can crash the recovery or drive large allocations. Exploitation requires control of the server side of the connection.
Reported by fg0x0
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free