org.mariadb.jdbc:mariadb-java-client 1.2.2

Direct Vulnerabilities

Known vulnerabilities in the org.mariadb.jdbc:mariadb-java-client package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
M Access Control Bypass Affected versions of this package are vulnerable to Access Control Bypass through the `ClientMessage` server-initiated LOCAL INFILE handling in `src/main/java/org/mariadb/jdbc/message/ClientMessage.java`. An attacker can make the client send a local file by replying to a `LOAD DATA LOCAL INFILE` request with a `0xfb` LOCAL INFILE packet even when local infile support is disabled. This lets a rogue or man-in-the-middle server read the file the application already named in its query, exposing that file’s contents to the attacker and defeating the intended `allowLocalInfile=false` safeguard. How to fix Access Control Bypass? Upgrade `org.mariadb.jdbc:mariadb-java-client` to version 2.7.14, 3.3.5, 3.4.3, 3.5.9 or higher.	[,2.7.14)[3.0.0,3.3.5)[3.4.0,3.4.3)[3.5.0,3.5.9)
H Inappropriate Encoding for Output Context Affected versions of this package are vulnerable to Inappropriate Encoding for Output Context in the `connection` process. An attacker can cause silent data corruption and potentially bypass input sanitization by manipulating the character set mid-session, leading to a mismatch between client and server encoding interpretations. How to fix Inappropriate Encoding for Output Context? Upgrade `org.mariadb.jdbc:mariadb-java-client` to version 2.7.14, 3.3.5, 3.4.3, 3.5.9 or higher.	[,2.7.14)[3.0.0,3.3.5)[3.4.0,3.4.3)[3.5.0,3.5.9)
H Insufficiently Protected Credentials Affected versions of this package are vulnerable to Insufficiently Protected Credentials in the initial-handshake process. An attacker can intercept and obtain database credentials by performing a man-in-the-middle attack during the authentication exchange when the connection is established with TLS verification enabled but without a pinned server certificate. This is only exploitable if the client is configured with sslMode=verify-full or verify-ca, uses a password, and does not pin the server certificate. How to fix Insufficiently Protected Credentials? Upgrade `org.mariadb.jdbc:mariadb-java-client` to version 2.7.14, 3.3.5, 3.4.3, 3.5.9 or higher.	[,2.7.14)[3.0.0,3.3.5)[3.4.0,3.4.3)[3.5.0,3.5.9)
H Insufficiently Protected Credentials Affected versions of this package are vulnerable to Insufficiently Protected Credentials via the `SendPamAuthPacketFactory` process. An attacker can obtain sensitive authentication credentials by intercepting network traffic or acting as a man-in-the-middle server during the authentication process. This is only exploitable if connections are made over plain TCP (sslMode=DISABLE) or a TLS mode that does not properly verify server identity, and the attacker can occupy an on-path position or control the server to present an Authentication Switch Request for the dialog plugin. How to fix Insufficiently Protected Credentials? Upgrade `org.mariadb.jdbc:mariadb-java-client` to version 2.7.14, 3.3.5, 3.4.3, 3.5.9 or higher.	[,2.7.14)[3.0.0,3.3.5)[3.4.0,3.4.3)[3.5.0,3.5.9)

Vulnerability

Vulnerable Version

Access Control Bypass

Affected versions of this package are vulnerable to Access Control Bypass through the ClientMessage server-initiated LOCAL INFILE handling in src/main/java/org/mariadb/jdbc/message/ClientMessage.java. An attacker can make the client send a local file by replying to a LOAD DATA LOCAL INFILE request with a 0xfb LOCAL INFILE packet even when local infile support is disabled. This lets a rogue or man-in-the-middle server read the file the application already named in its query, exposing that file’s contents to the attacker and defeating the intended allowLocalInfile=false safeguard.

How to fix Access Control Bypass?

Upgrade org.mariadb.jdbc:mariadb-java-client to version 2.7.14, 3.3.5, 3.4.3, 3.5.9 or higher.

[,2.7.14)[3.0.0,3.3.5)[3.4.0,3.4.3)[3.5.0,3.5.9)

Inappropriate Encoding for Output Context

Affected versions of this package are vulnerable to Inappropriate Encoding for Output Context in the connection process. An attacker can cause silent data corruption and potentially bypass input sanitization by manipulating the character set mid-session, leading to a mismatch between client and server encoding interpretations.

How to fix Inappropriate Encoding for Output Context?

Upgrade org.mariadb.jdbc:mariadb-java-client to version 2.7.14, 3.3.5, 3.4.3, 3.5.9 or higher.

[,2.7.14)[3.0.0,3.3.5)[3.4.0,3.4.3)[3.5.0,3.5.9)

Insufficiently Protected Credentials

Affected versions of this package are vulnerable to Insufficiently Protected Credentials in the initial-handshake process. An attacker can intercept and obtain database credentials by performing a man-in-the-middle attack during the authentication exchange when the connection is established with TLS verification enabled but without a pinned server certificate. This is only exploitable if the client is configured with sslMode=verify-full or verify-ca, uses a password, and does not pin the server certificate.

How to fix Insufficiently Protected Credentials?

Upgrade org.mariadb.jdbc:mariadb-java-client to version 2.7.14, 3.3.5, 3.4.3, 3.5.9 or higher.

[,2.7.14)[3.0.0,3.3.5)[3.4.0,3.4.3)[3.5.0,3.5.9)

Insufficiently Protected Credentials

Affected versions of this package are vulnerable to Insufficiently Protected Credentials via the SendPamAuthPacketFactory process. An attacker can obtain sensitive authentication credentials by intercepting network traffic or acting as a man-in-the-middle server during the authentication process. This is only exploitable if connections are made over plain TCP (sslMode=DISABLE) or a TLS mode that does not properly verify server identity, and the attacker can occupy an on-path position or control the server to present an Authentication Switch Request for the dialog plugin.

How to fix Insufficiently Protected Credentials?

Upgrade org.mariadb.jdbc:mariadb-java-client to version 2.7.14, 3.3.5, 3.4.3, 3.5.9 or higher.

[,2.7.14)[3.0.0,3.3.5)[3.4.0,3.4.3)[3.5.0,3.5.9)

org.mariadb.jdbc:mariadb-java-client@1.2.2

latest version

latest non vulnerable version

first published

latest version published

licenses detected

package registry

Direct Vulnerabilities

Fix vulnerabilities automatically