Use of Uninitialized Variable in trilogy

CAO 7.5CVE-2022-31026 · GHSA-5g4r-2qhx-vqfm · Công bố 09/06/2022 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2022-31026 là lỗ hổng mức CAO (CVSS 7.5) ảnh hưởng trilogy, trilogy (trilogy project).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 1.1%, cao hơn 65.7% các lỗ hổng khác.
Cách xử lý: cập nhật lên 2.1.1 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
trilogy RubyGems	`< 2.1.1`	`2.1.1`
trilogy trilogy_project	`< 2.1.1`	`2.1.1`

Mô tả

Impact

When authenticating, a malicious server could return a specially crafted authentication packet, causing the client to read and return up to 12 bytes of data from an uninitialized variable in stack memory.

Patches

Users of the trilogy gem should upgrade to version 2.1.1

Workarounds

This issue can be avoided by only connecting to trusted servers.

Acknowledgements

We would like to thank Sergei Volokitin for reporting this vulnerability

For more information

If you have any questions or comments about this advisory:

Open an issue in trilogy

Mô tả của NVD

Trilogy is a client library for MySQL. When authenticating, a malicious server could return a specially crafted authentication packet, causing the client to read and return up to 12 bytes of data from an uninitialized variable in stack memory. Users of the trilogy gem should upgrade to version 2.1.1 This issue can be avoided by only connecting to trusted servers.