Description
A script injection vulnerability was found in the Debezium database connector, where it does not properly sanitize some parameters. This flaw allows an attacker to send a malicious request to inject a parameter that may allow the viewing of unauthorized data.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat build of Debezium | — | — |
| Red Hat | Red Hat Integration Change Data Capture | — | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | io.debezium:debezium-connector-mysql | < 2.3.0.Alpha1 | 2.3.0.Alpha1 | GHSA-hvw5-3mgw-7rcf |
| Maven | io.debezium:debezium-connector-sqlserver | < 2.3.0.Alpha1 | 2.3.0.Alpha1 | GHSA-hvw5-3mgw-7rcf |
| Maven | io.debezium:debezium-core | < 2.3.0.Alpha1 | 2.3.0.Alpha1 | GHSA-hvw5-3mgw-7rcf |
References
- https://access.redhat.com/security/cve/CVE-2023-1419 vdb-entry
- RHBZ#2178722 issue-tracking