CVE-2023-29194: linuxfoundation vitess Improper Input Validation

Vulnerability summary

CVE-2023-29194 is a medium (CVSS 4.1) Improper Input Validation vulnerability in linuxfoundation vitess. EPSS estimates a 0.78% chance of exploitation in the next 30 days, higher than 55.2% of scored vulnerabilities.

Timeline

1. 14-04-2023
   PublishedVulnerability first disclosed.
2. 06-02-2025
   Last modifiedVulnerability information updated.

Description

Vitess is a database clustering system for horizontal scaling of MySQL. Users can either intentionally or inadvertently create a keyspace containing `/` characters such that from that point on, anyone who tries to view keyspaces from VTAdmin will receive an error. Trying to list all the keyspaces using `vtctldclient GetKeyspaces` will also return an error. Note that all other keyspaces can still be administered using the CLI (vtctldclient). This issue is fixed in version 16.0.1. As a workaround, delete the offending keyspace using a CLI client (vtctldclient).

• CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
• CWE-703Improper Check or Handling of Exceptional ConditionsThe product does not properly anticipate or handle exceptional conditions that rarely occur during normal operation of the product.