Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 9.0.0-9.2.0. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2025-20089-1 advisory.

    - Upgrade to Version 9.3.0
      - CVE-2025-30706: Fixed Connector/J vulnerability (bsc#1241693)
      - Updatable ResultSet fails with 'Parameter index out of range'.
      - Fixed Resultset UPDATE methods not checking validity of ResultSet.
      - DatabaseMetaData clean up.
      - Fixed implement missing methods in DatabaseMetaDataUsingInfoSchema.
      - Fixed procedure execution failing when the parameter name contains escape character.
      - Fixed allow only Krb5LoginModule in Kerberos authentication.
      - Fixed EXECUTE on CallableStatement resulting in ArrayIndexOutOfBoundsException.
      - Mysql connector use an uneffective way to match numericValue.
      - Fixed parameter index validation not proper in CallableStatement

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions     that are affected are 9.0.0-9.2.0. Difficult to exploit vulnerability allows low privileged attacker with     network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this     vulnerability can result in takeover of MySQL Connectors. (CVE-2025-30706)

Note that Nessus relies on the presence of the package as reported by the vendor.

The 9.0.0, 9.1.0 and 9.2.0 versions of MySQL Connectors installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2025 CPU advisory.

  - Use of the low-level GF(2^m) elliptic curve APIs with untrusted explicit values for the field polynomial     can lead to out-of-bounds memory reads or writes. (CVE-2024-9143)

  - Issue summary: Use of the low-level GF(2^m) elliptic curve APIs with untrusted explicit values for the     field polynomial can lead to out-of-bounds memory reads or writes. Impact summary: Out of bound memory     writes can lead to an application crash or even a possibility of a remote code execution, however, in all     the protocols involving Elliptic Curve Cryptography that we're aware of, either only named curves are     supported, or, if explicit curve parameters are supported, they specify an X9.62 encoding of binary     (GF(2^m)) curves that can't represent problematic input values. Thus the likelihood of existence of a     vulnerable application is low. In particular, the X9.62 encoding is used for ECC keys in X.509     certificates, so problematic inputs cannot occur in the context of processing X.509 certificates. Any     problematic use-cases would have to be using an exotic curve encoding. The affected APIs include:
    EC_GROUP_new_curve_GF2m(), EC_GROUP_new_from_params(), and various supporting BN_GF2m_*() functions.
    Applications working with exotic explicit binary (GF(2^m)) curve parameters, that make it possible to     represent invalid field polynomials with a zero constant term, via the above or similar APIs, may     terminate abruptly as a result of reading or writing outside of array bounds. Remote code execution cannot     easily be ruled out. The FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.
    (CVE-2024-9143)

  - Issue summary: A timing side-channel which could potentially allow recovering the private key exists in     the ECDSA signature computation. Impact summary: A timing side-channel in ECDSA signature computations     could allow recovering the private key by an attacker. However, measuring the timing would require either     local access to the signing application or a very fast network connection with low latency. There is a     timing signal of around 300 nanoseconds when the top word of the inverted ECDSA nonce value is zero. This     can happen with significant probability only for some of the supported elliptic curves. In particular the     NIST P-521 curve is affected. To be able to measure this leak, the attacker process must either be located     in the same physical computer or must have a very fast network connection with low latency. For that     reason the severity of this vulnerability is Low. The FIPS modules in 3.4, 3.3, 3.2, 3.1 and 3.0 are     affected by this issue. (CVE-2024-13176)

  - Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions     that are affected are 9.0.0-9.2.0. Difficult to exploit vulnerability allows low privileged attacker with     network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this     vulnerability can result in takeover of MySQL Connectors. (CVE-2025-30706)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
277020	openSUSE 16 Security Update : mysql-connector-java (openSUSE-SU-2025-20089-1)	Nessus	SuSE Local Security Checks	high
260534	Linux Distros Unpatched Vulnerability : CVE-2025-30706	Nessus	Misc.	high
234560	Oracle MySQL Connectors (April 2025 CPU)	Nessus	Misc.	high

Detections

Analytics

CVE-2025-30706

high

Tenable Plugins

high

high

high