CVE-2019-2435

Vulnerability

CVE-2019-2435 is a high-severity vulnerability in the MySQL Connector/Python component of Oracle MySQL, affecting versions 8.0.13 and prior, as well as version 2.1.8 and prior [1]. The flaw resides in the Connector/Python subcomponent and is triggered during TLS network communication. It requires no authentication but depends on human interaction from a person other than the attacker, such as a victim clicking a link or opening a crafted file [1].

Exploitation

An unauthenticated attacker with network access can exploit this vulnerability via TLS, likely by performing a man-in-the-middle attack or delivering a malicious payload that the victim must interact with (e.g., accepting a certificate or opening a crafted connection string) [1]. The attack complexity is low, and no privileges are required, but successful exploitation depends on the victim taking a specific action [1].

Impact

Successful exploitation of CVE-2019-2435 results in both unauthorized access to read (confidentiality breach) and unauthorized creation, deletion, or modification (integrity breach) of all data accessible to the MySQL Connector/Python, including potentially critical data [1]. The CVSS 3.0 base score is 8.1 (High), with a vector string of AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N, indicating high impact on confidentiality and integrity, but no impact on availability [1].

Mitigation

Oracle has fixed this vulnerability in the Critical Patch Update (CPU) of January 2019. Users should upgrade to MySQL Connector/Python 8.0.14 or later, or to version 2.1.9 or later [1]. There is no known workaround, and applying the official patch is the only recommended mitigation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog as of the publication date.