{"schema":"threatline.record/2","record":{"id":"GHSA-473q-m89c-ghf8","aliases":["GHSA-473q-m89c-ghf8"],"summary":"MySqlConnector: Account password disclosed to a man-in-the-middle in zero-configuration TLS mode (clear-text password sent before certificate is verified)","details":"## Summary\n\nWith `SslMode` set to `VerifyCA` or `VerifyFull` with no configured CA certificate, an unvalidated TLS connection is treated as secure and a clear-text password can be sent before the certificate is checked. This can occur when relying on the password to validate a self-signed cert, e.g., MariaDB's [zero-configuration TLS](https://mariadb.com/docs/server/security/encryption/data-in-transit-encryption/zero-configuration-ssl).\n\n## Impact\n\nAn attacker who can deploy a man-in-the-middle MySQL proxy presenting any self-signed certificate can capture the plaintext database password of a client that:\n\n- uses `SslMode = VerifyCA` or `VerifyFull`, and\n- does not use the `SslCa` connection string option, and\n- uses a non-empty password.\n\nThe attacker completes the TLS handshake with its own cert, requests a clear-text password authentication scheme (`mysql_clear_password`, or forces the `caching_sha2_password`/`sha256_password` clear-text fallback), and receives the password before the fingerprint check rejects the connection, defeating the man-in-the-middle protection `VerifyFull` is expected to provide. \n\nNot affected: a configured CA (`SslCa`), CA-validated TLS, local connections (Unix socket / loopback), or empty passwords. Using `SslMode` set to `Preferred` or `Required` is out of scope (this is documented as not authenticating the server).\n\n## Workarounds\n\nProvide `SslCa` with `VerifyCA`/`VerifyFull`, use a local/Unix-socket connection, or avoid clear-text authentication.\n\n## References\n\n- https://mariadb.org/mission-impossible-zero-configuration-ssl/","categories":["Libraries & packages"],"product":"MySqlConnector","vendor":"","ecosystem":"nuget","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-473q-m89c-ghf8","source_modified_at":"2026-10-28T19:49:45Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"ecosystem":"nuget","name":"MySqlConnector"},"range":"< 2.6.1"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-473q-m89c-ghf8","source_modified_at":"2026-10-28T20:00:04.871955012Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"MySqlConnector","ecosystem":"NuGet","purl":"pkg:nuget/MySqlConnector"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1"}]}],"versions":["0.1.0","0.1.0-alpha01","0.1.0-alpha02","0.1.0-alpha03","0.1.0-alpha04","0.1.0-alpha05","0.1.0-alpha06","0.1.0-alpha07","0.1.0-alpha08","0.1.0-alpha09","0.1.0-alpha10","0.1.0-alpha11","0.1.0-alpha12","0.1.0-alpha13","0.1.0-alpha14","0.1.0-alpha15","0.1.0-alpha16","0.1.0-alpha17","0.1.0-alpha18","0.1.0-alpha19","0.1.0-alpha20","0.1.0-alpha21","0.1.0-alpha22","0.1.0-alpha23","0.1.0-alpha24","0.1.0-alpha25","0.1.0-alpha26","0.10.0","0.11.0","0.11.1","0.11.2","0.11.3","0.11.4","0.11.5","0.11.6","0.12.0","0.13.0","0.14.0","0.14.1","0.15.0","0.15.1","0.16.0","0.16.1","0.16.2","0.17.0","0.18.0","0.18.1","0.18.2","0.18.3","0.19.0"]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-473q-m89c-ghf8","source_modified_at":"2026-10-28T19:49:45Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"ecosystem":"nuget","name":"MySqlConnector"},"version":"2.6.1"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-473q-m89c-ghf8","source_modified_at":"2026-10-28T20:00:04.871955012Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"MySqlConnector","ecosystem":"NuGet","purl":"pkg:nuget/MySqlConnector"},"version":"2.6.1"}],"cvss":6.9,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-28T19:49:44Z","modified_at":"2026-10-28T20:00:04.871955012Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-473q-m89c-ghf8","fetched_at":"2026-10-28T20:58:01.013507Z","source_modified_at":"2026-10-28T19:49:45Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-473q-m89c-ghf8","fetched_at":"2026-10-28T20:58:01.013507Z","source_modified_at":"2026-10-28T20:00:04.871955012Z"}],"sources":["GitHub Advisory Database","OSV"],"references":[{"url":"https://github.com/mysql-net/MySqlConnector/security/advisories/GHSA-473q-m89c-ghf8","source":"GitHub Advisory Database"},{"url":"https://github.com/mysql-net/MySqlConnector/commit/86503613fe3b72ae26c03dd1ea92f0e1e6e208f9","source":"GitHub Advisory Database"},{"url":"https://github.com/mysql-net/MySqlConnector/releases/tag/2.6.1","source":"GitHub Advisory Database"},{"url":"https://github.com/advisories/GHSA-473q-m89c-ghf8","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-28T20:00:04.871955012Z","content_hash":"e28b283bd55849d2cd5a7eded43f005de52d154441da4e427751bea13e911a77"}}