github_osv/GHSA-5f7m-mmpc-qhh4
mysql Node.JS Module Vulnerable to Remote Memory Exposure
Versions of `mysql` before 2.14.0 are vulnerable to remove memory exposure.
Affected versions of `mysql` package allocate and send an uninitialized memory over the network when a number is provided as a password.
Only `mysql` running on Node.js versions below 6.0.0 are affected due to a throw added in newer node.js versions.
Proof of Concept:
```
require('mysql').createConnection({
host: 'localhost',
user: 'user',
password : USERPROVIDEDINPUT, // number
database : 'my_db'
}).connect();
```
## Recommendation
Update to version 2.14.0 or later.
gitlab/npm/mysql/GMS-2019-136
Remote Memory Exposure in mysql
Versions of `mysql` before 2.14.0 is vulnerable to remove memory exposure.
Affected versions of `mysql` package allocate and send an uninitialized memory over the network when a number is provided as a password.
Only `mysql` running on Node.js versions below 6.0.0 is affected due to a throw added in newer node.js versions.
Proof of Concept:
```
require('mysql').createConnection({
host: 'localhost',
user: 'user',
password : USERPROVIDEDINPUT, // number
database : 'my_db'
}).connect();
```
## Recommendation
Update to version 2.14.0 or later.