CVE-2023-29195: falha de média gravidade em vitessio vitess
Vitess VTAdmin users that can create shards can deny access to other functions
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 4.1epss 1.0%
Vitess is a database clustering system for horizontal scaling of MySQL through generalized sharding. Prior to version 16.0.2, users can either intentionally or inadvertently create a shard containing `/` characters from VTAdmin such that from that point on, anyone who tries to create a new shard from VTAdmin will receive an error. Attempting to view the keyspace(s) will also no longer work. Creating a shard using `vtctldclient` does not have the same problem because the CLI validates the input correctly. Version 16.0.2, corresponding to version 0.16.2 of the `go` module, contains a patch for this issue. Some workarounds are available. Always use `vtctldclient` to create shards, instead of using VTAdmin; disable creating shards from VTAdmin using RBAC; and/or delete the topology record for the offending shard using the client for your topology server.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L
Produtos afetados
vitessio · vitessCVEs relacionadas — vitessio vitess
No mesmo produto, das mais perigosas para as menos.
CVE-2026-104252CRITICALVitess vttablet /twopcz reflected XSSEPSS 1.2%CVE-2023-29194MEDIUMvitess allows users to create keyspaces that can deny access to already existing keyspacesEPSS 0.8%CVE-2024-32886MEDIUMVitess vulnerable to infinite memory consumption and vtgate crashEPSS 0.8%CVE-2026-27969CRITICALVitess users with backup storage access can write to arbitrary file paths on restoreEPSS 0.5%CVE-2026-27965HIGHVitess users with backup storage access can gain unauthorized access to production deployment environmentsEPSS 0.5%CVE-2024-53257MEDIUMVitess allows HTML injection in /debug/querylogz & /debug/envEPSS 0.4%
Referências
https://github.com/vitessio/vitess/commit/9dcbd7de3180f47e94f54989fb5c66daea00c920https://github.com/vitessio/vitess/issues/12842https://github.com/vitessio/vitess/pull/12843https://github.com/vitessio/vitess/releases/tag/v16.0.2https://github.com/vitessio/vitess/security/advisories/GHSA-pqj7-jx24-wj7whttps://pkg.go.dev/vitess.io/vitess@v0.16.2