MySqlConnector: Account password disclosed to a man-in-the-middle in zero-configuration TLS mode (clear-text password sent before certificate is verified)

影響: nuget:MySqlConnector < 2.6.1 → 2.6.1

With SslMode set to VerifyCA or VerifyFull with no configured CA certificate, an unvalidated TLS connection is treated as secure and a clear-text password can be sent before the certificate is checked. This can occur when relying on the password to validate a self-signed cert, e.g., MariaDB's [zero-configuration TLS](https://mariadb.com/docs/server/security/encryption/data-in-transit-encryption/zero-configuration-ssl). Impact An attacker who can deploy a man-in-the-middle MySQL proxy presenting…

GitHub Advisory Databaseで読む

2026/10/29 04:49、GitHub Advisory Databaseが「MySqlConnector: Account password disclosed to a man-in-the-middle in zero-configuration TLS mode (clear-text password sent before certificate is verified)」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「警告」(medium) です。関連する技術: .NET / C#、MySQL / MariaDB。