Improper Check or Handling of Exceptional Conditions
CVE-2023-29195
Summary
Vitess is a database clustering system for horizontal scaling of MySQL through generalized sharding. Vitess versions through 0.16.1 and 2.0.0-alpha1 through 16.0.1, users can either intentionally or inadvertently create a shard containing "/" characters from VTAdmin such that from that point on, anyone who tries to create a new shard from VTAdmin will receive an error. Attempting to view the keyspace(s) will also no longer work. Creating a shard using "vtctldclient" does not have the same problem because the CLI validates the input correctly "go" module, contains a patch for this issue. Some workarounds are available. Always use "vtctldclient" to create shards, instead of using VTAdmin; disable creating shards from VTAdmin using RBAC; and/or delete the topology record for the offending shard using the client for your topology server.
- LOW
- NETWORK
- NONE
- UNCHANGED
- NONE
- LOW
- NONE
- LOW
CWE-703 - Improper Check or Handling of Exceptional Conditions
The software does not properly anticipate or handle exceptional conditions that rarely occur during normal operation of the software.
References
Advisory Timeline
- Published