What is the latest Mysql high-risk vulnerability?

This article shows you what the latest Mysql high-risk vulnerabilities are like, concise and easy to understand, which will definitely brighten your eyes. I hope you can get something through the details of this article.

MySQL officials recently made a large security vulnerability patch, fixed 25 security vulnerabilities, the details of these vulnerabilities so far there are relatively few official and media introduction and analysis articles. From the email discussion group to some details, here are some of the more important and high-risk vulnerabilities. Including CVE-2018-2696 and CVE-2018-2562.

CVE-2018-2696 mysql: sha256_password authentication long password reject attack

The vulnerability stems from the MySQL sha256_password authentication plug-in, which does not limit the length of the authentication password, but is passed directly to my_crypt_genhash () to encrypt the password with SHA256 to hash the password. This calculation process requires a lot of CPU computation, and if a long password is passed, it will cause CPU exhaustion. Moreover, in the implementation of the formula Mysql, alloca () is used for memory allocation, which can not protect the memory stack overflow, which may lead to memory leakage, process crash, and code execution.

MySQL