Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
A nil pointer dereference in PingCAP TiDB v8.2.0-alpha-216-gfe5858b allows attackers to crash the application via expression.inferCollation.
Recommended action: Upgrade to 8.2.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
5.3.10.0.0-20220221072141-27ffd1126da11.1.0-beta.0.20220221072141-27ffd1126da1· Vendor fix available
Issue
Impact Under certain conditions, an attacker can construct malicious authentication requests to bypass the authentication process, resulting in privilege escalation or unauthorized access. Only users using TiDB 5.3.0 are affected by this vulnerability. Patches Please upgrade to TiDB 5.3.1 or higher version Workarounds You can also mitigate risks by taking the following measures. Option 1: Turn off SEM (Security Enhanced Mode). Option 2: Disable local login for non-root accounts and ensure that the same IP cannot be logged in as root or normal user at the same time. References https://en.pingcap.com/download/ For more information If you have any questions or comments about this advisory: Email us at security@tidb.io
Recommended action: Upgrade to 5.3.1, 1.1.0-beta.0.20220221072141-27ffd1126da1 (pre-release) or 0.0.0-20220221072141-27ffd1126da1 (pre-release) by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.