CVE-2022-31026CWE-908

Use of Uninitialized Variable in trilogy

Medium · published June 6, 2022

CVSS v3.1
5.9
EPSS
1%
Percentile
64.7
In the wild
Unconfirmed
What it is

Trilogy is a client library for MySQL. When authenticating, a malicious server could return a specially crafted authentication packet, causing the client to read and return up to 12 bytes of data from an uninitialized variable in stack memory. Users of the trilogy gem should upgrade to version 2.1.1 This issue can be avoided by only connecting to trusted servers.

The record
Technical detail
CVSS v3.1
5.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.01077 · 64.7th percentile
Weakness
CWE-908 · Use of Uninitialized Resource
Published
2022-06-06T21:05Z
EPSS history
Timeline
  • 06 JUN 21:05Z
    Use of Uninitialized Variable in trilogy
    cvelistv5