CVE-2023-29194: vitess allows users to create keyspaces that can deny access to already existing keyspaces
Impact Users can either intentionally or inadvertently create a keyspace containing / characters such that from that point on, anyone who tries to view keyspaces from VTAdmin will receive an error. Trying to list all the keyspaces using vtctldclient GetKeyspaces will also return an error. Note that all other keyspaces can still be administered using the CLI (vtctldclient).
Patches v16.0.1 (corresponding to 0.16.1 on pkg.go.dev)
Workarounds Delete the offending keyspace using a CLI client (vtctldclient) vtctldclient --server ... DeleteKeyspace a/b
Found during a security audit sponsored by the CNCF and facilitated by OSTIF.
Other sources
Vitess is a database clustering system for horizontal scaling of MySQL. Users can either intentionally or inadvertently create a keyspace containing / characters such that from that point on, anyone who tries to view keyspaces from VTAdmin will receive an error. Trying to list all the keyspaces using vtctldclient GetKeyspaces will also return an error. Note that all other keyspaces can still be administered using the CLI (vtctldclient). This issue is fixed in version 16.0.1. As a workaround, delete the offending keyspace using a CLI client (vtctldclient).
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-29194?
CVE-2023-29194 has been reported as a vulnerability that can potentially disrupt user access to keyspaces in Vitess.
How do I fix CVE-2023-29194?
To address CVE-2023-29194, upgrade Vitess to version 0.16.1 or later.
What are the affected versions for CVE-2023-29194?
CVE-2023-29194 affects Vitess versions prior to 0.16.1.
Can CVE-2023-29194 impact database operations?
Yes, CVE-2023-29194 can prevent users from being able to list and access keyspaces, disrupting normal database operations.
What software is impacted by CVE-2023-29194?
CVE-2023-29194 affects Vitess software, specifically versions prior to 0.16.1 released by the Linux Foundation.