Skip to main content

Improper Check or Handling of Exceptional Conditions

CVE-2023-29195

Severity Medium
Score 4.3/10

Summary

Vitess is a database clustering system for horizontal scaling of MySQL through generalized sharding. Vitess versions through 0.16.1 and 2.0.0-alpha1 through 16.0.1, users can either intentionally or inadvertently create a shard containing "/" characters from VTAdmin such that from that point on, anyone who tries to create a new shard from VTAdmin will receive an error. Attempting to view the keyspace(s) will also no longer work. Creating a shard using "vtctldclient" does not have the same problem because the CLI validates the input correctly "go" module, contains a patch for this issue. Some workarounds are available. Always use "vtctldclient" to create shards, instead of using VTAdmin; disable creating shards from VTAdmin using RBAC; and/or delete the topology record for the offending shard using the client for your topology server.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • LOW
  • NONE
  • LOW

CWE-703 - Improper Check or Handling of Exceptional Conditions

The software does not properly anticipate or handle exceptional conditions that rarely occur during normal operation of the software.

Advisory Timeline

  • Published