TiDB authentication bypass vulnerability
Description
TiDB is an open-source NewSQL database that supports Hybrid Transactional and Analytical Processing (HTAP) workloads. Under certain conditions, an attacker can construct malicious authentication requests to bypass the authentication process, resulting in privilege escalation or unauthorized access. Only users using TiDB 5.3.0 are affected by this vulnerability. TiDB version 5.3.1 contains a patch for this issue. Other mitigation strategies include turning off Security Enhanced Mode (SEM), disabling local login for non-root accounts, and ensuring that the same IP cannot be logged in as root and normal user at the same time.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/pingcap/tidbGo | >= 5.3.0, < 5.3.1 | 5.3.1 |
github.com/pingcap/tidbGo | >= 0.0.0-20210808221113-a7fdc2a05663, < 0.0.0-20220221072141-27ffd1126da1 | 0.0.0-20220221072141-27ffd1126da1 |
github.com/pingcap/tidbGo | >= 1.1.0-beta.0.20210808221113-a7fdc2a05663, < 1.1.0-beta.0.20220221072141-27ffd1126da1 | 1.1.0-beta.0.20220221072141-27ffd1126da1 |
Affected products
2Patches
Vulnerability mechanics
References
4- github.com/advisories/GHSA-4whx-7p29-mq22ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2022-31011ghsaADVISORY
- github.com/pingcap/tidb/releases/tag/v5.3.1ghsax_refsource_MISCWEB
- github.com/pingcap/tidb/security/advisories/GHSA-4whx-7p29-mq22ghsax_refsource_CONFIRMWEB
News mentions
0No linked articles in our index yet.