Vitess is a database clustering system for horizontal scaling of MySQL. The /debug/querylogz and /debug/env pages for vtgate and vttablet do not properly escape user input. The result is that queries executed by Vitess can write HTML into the monitoring page at will. These pages are rendered using text/template instead of rendering with a proper HTML templating engine. This vulnerability is fixed in 21.0.1, 20.0.4, and 19.0.8.

The version of vitess installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-53257 advisory.

  - Vitess is a database clustering system for horizontal scaling of MySQL. The /debug/querylogz and     /debug/env pages for vtgate and vttablet do not properly escape user input. The result is that queries     executed by Vitess can write HTML into the monitoring page at will. These pages are rendered using     text/template instead of rendering with a proper HTML templating engine. This vulnerability is fixed in     21.0.1, 20.0.4, and 19.0.8. (CVE-2024-53257)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of vitess installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-53257 advisory.

  - Vitess is a database clustering system for horizontal scaling of MySQL. The /debug/querylogz and     /debug/env pages for vtgate and vttablet do not properly escape user input. The result is that queries     executed by Vitess can write HTML into the monitoring page at will. These pages are rendered using     text/template instead of rendering with a proper HTML templating engine. This vulnerability is fixed in     21.0.1, 20.0.4, and 19.0.8. (CVE-2024-53257)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Vitess is a database clustering system for horizontal scaling of MySQL. The /debug/querylogz and
    /debug/env pages for vtgate and vttablet do not properly escape user input. The result is that queries
    executed by Vitess can write HTML into the monitoring page at will. These pages are rendered using
    text/template instead of rendering with a proper HTML templating engine. This vulnerability is fixed in
    21.0.1, 20.0.4, and 19.0.8. (CVE-2024-53257)

ID	Name	Product	Family	Severity
234535	Azure Linux 3.0 Security Update: vitess (CVE-2024-53257)	Nessus	Azure Linux Local Security Checks	medium
233154	CBL Mariner 2.0 Security Update: vitess (CVE-2024-53257)	Nessus	MarinerOS Local Security Checks	medium
412157	SCA: security update for vitess.io/vitess (GHSA-7mwh-q3xm-qh6p)	Tenable Cloud Security	SCA Checks	medium
412157	SCA: security update for vitess.io/vitess (GHSA-7mwh-q3xm-qh6p)	Tenable Self-Hosted Container Security	SCA Checks	medium

Detections

Analytics

CVE-2024-53257

medium

Tenable Plugins

medium

medium

medium

medium