jruby/activerecord-jdbc-adapter

Update for CVE-2021-2471 ?

dennisbulgatz opened this issue · 1 comments

dennisbulgatz commented

Question.. is anyone working to address CVE-2021-2471 ?

Per CVE-2021-2471, mysql-connector-java ≤ 8.0.26 is vulnerable to an XML attack. From Snyk:

mysql:mysql-connector-java is a provides connectivity for client applications developed in the Java programming language with MySQL Connector/J, a driver that implements the Java Database Connectivity (JDBC) API.

Affected versions of this package are vulnerable to XML External Entity (XXE) Injection via the getSource() method, due to a missing check for external entities

Mitigation steps

Upgrade mysql-connector-java to 8.0.27 or higher

kares commented

we pushed jdbc-mysql 8.0.27 however please note that using a library does not mean being exposed.
in AR-JDBC (and thus any JRuby on Rails app) we do not use getSource for XML from the JDBC API.