CVE-2023-40354: Medium severity mariadb maxscale vulnerability
An issue was discovered in MariaDB MaxScale before 23.02.3. A user enters an encrypted password on a "maxctrl create service" command line, but this password is then stored in cleartext in the resulting .cnf file under /var/lib/maxscale/maxscale.cnf.d. The fixed versions are 2.5.28, 6.4.9, 22.08.8, and 23.02.3.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2023-40354.
What is the severity rating of CVE-2023-40354?
CVE-2023-40354 has a severity rating of 6.5 (medium).
What is the affected software of CVE-2023-40354?
The affected software of CVE-2023-40354 is MariaDB MaxScale versions 2.5.28, 6.4.9, 22.08.8, and 23.02.3.
How does this vulnerability occur?
This vulnerability occurs when a user enters an encrypted password on a "maxctrl create service" command line, but the password is stored in cleartext in the resulting .cnf file under /var/lib/maxscale/maxscale.cnf.d.
What is the fix for CVE-2023-40354?
The fix for CVE-2023-40354 is to update to the fixed versions of MariaDB MaxScale (2.5.28, 6.4.9, 22.08.8, or 23.02.3).