CVE-2022-31011
Description
TiDB is an open-source NewSQL database that supports Hybrid Transactional and Analytical Processing (HTAP) workloads. Under certain conditions, an attacker can construct malicious authentication requests to bypass the authentication process, resulting in privilege escalation or unauthorized access. Only users using TiDB 5.3.0 are affected by this vulnerability. TiDB version 5.3.1 contains a patch for this issue. Other mitigation strategies include turning off Security Enhanced Mode (SEM), disabling local login for non-root accounts, and ensuring that the same IP cannot be logged in as root and normal user at the same time.
How to fix
- github.com/pingcap/tidb5.3.1, 0.0.0-20220221072141-27ffd1126da1, 1.1.0-beta.0.20220221072141-27ffd1126da1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pingcap tidb | 5.3.0 | — |
| github.com/pingcap/tidbGo | 5.3.0 ≤ v < 5.3.1, 0.0.0-20210808221113-a7fdc2a05663 ≤ v < 0.0.0-20220221072141-27ffd1126da1, 1.1.0-beta.0.20210808221113-a7fdc2a05663 ≤ v < 1.1.0-beta.0.20220221072141-27ffd1126da1 | 5.3.1, 0.0.0-20220221072141-27ffd1126da1, 1.1.0-beta.0.20220221072141-27ffd1126da1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.