A malicious MySQL server can request local file content from a client using ruby-mysql prior to version 2.10.0 without explicit authorization from the user. This issue was resolved in version 2.10.0 and later.
The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Ruby-mysql | Ruby-mysql_project | * | 2.10.0 (excluding) |
| Ruby-mysql | Ubuntu | esm-apps/xenial | * |