GHSA-7fxj-fr3v-r9gjCriticalCVSS 9.8

TiDB vulnerable to Use of Externally-Controlled Format String

Published
November 4, 2022
Last Modified
February 3, 2023

🔗 CVE IDs covered (1)

CVE-2022-3023 →

📋 Description

TiDB server (importer CLI tool) prior to version 6.4.0 & 6.1.3 is vulnerable to data source name injection. The database name for generating and inserting data into a database does not properly sanitize user input which can lead to arbitrary file reads."

🎯 Affected products2

  • go/github.com/pingcap/tidb:<= 6.1.2
  • go/github.com/pingcap/tidb:>= 6.2.0, <= 6.4.0-alpha1

🔗 References (5)