CVE-2022-31026

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Trilogy is a client library for MySQL. When authenticating, a malicious server could return a specially crafted authentication packet, causing the client to read and return up to 12 bytes of data from an uninitialized variable in stack memory. Users of the trilogy gem should upgrade to version 2.1.1 This issue can be avoided by only connecting to trusted servers.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-908

Affected software

Vendor	Product	Versions
github	trilogy	< 2.1.1

References

https://github.com/github/trilogy/commit/6bed62789eaf119902b0fe247d2a91d56c31a962Patch, Third Party Advisory
https://github.com/github/trilogy/security/advisories/GHSA-5g4r-2qhx-vqfmThird Party Advisory
https://github.com/github/trilogy/commit/6bed62789eaf119902b0fe247d2a91d56c31a962Patch, Third Party Advisory
https://github.com/github/trilogy/security/advisories/GHSA-5g4r-2qhx-vqfmThird Party Advisory

Timeline

Published: Jun 9, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-310276.5OAuthenticator is an OAuth token library for the JupyerHub login handler. CILogonOAuthenticator is provided by the OAuthenticator package, a CVE-2022-310287.5MinIO is a multi-cloud object storage solution. Starting with version RELEASE.2019-09-25T18-25-51Z and ending with version RELEASE.2022-06-0 CVE-2022-310294.8AdminLTE is a Pi-hole Dashboard for stats and configuration. In affected versions inserting code like `<script>alert("XSS")</script>` in the CVE-2022-31037.8off-by-one in io_uring module.CVE-2022-310305.5containerd is an open source container runtime. A bug was found in the containerd's CRI implementation where programs inside a container can CVE-2022-310319.8PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SD CVE-2022-310324.3Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In versions prior to 13.9.99.58 autho CVE-2022-310337.5The Mechanize library is used for automating interaction with websites. Mechanize automatically stores and sends cookies, follows redirects,CVE-2022-310348.1Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting with v0.11.0 are vulnerable to a CVE-2022-310355.4Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting with v1.0.0 are vulnerable to a c CVE-2022-310364.3Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting with v1.3.0 are vulnerable to a s CVE-2022-310375.4OroCommerce is an open-source Business to Business Commerce application. Versions between 4.1.0 and 4.1.17 inclusive, 4.2.0 and 4.2.11 inclu