SUSE alert openSUSE-SU-2025-20089-1 (mysql-connector-java)

From:
             
 
meissner@suse.com
To:
             
 
security-announce@lists.opensuse.org
Subject:
             
 
openSUSE-SU-2025-20089-1: important: Security update for mysql-connector-java
Date:
             
 
Thu, 27 Nov 2025 09:35:58 +0100
Message-ID:
             
 
<20251127083558.10520FBA0@maintenance.suse.de>
Archive-link:
             
 
Article
openSUSE security update: security update for mysql-connector-java
-------------------------------------------------------------

Announcement ID: openSUSE-SU-2025-20089-1
Rating: important
References:

  * bsc#1241693



Cross-References:

  * CVE-2025-30706



CVSS scores:

  * CVE-2025-30706 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
  * CVE-2025-30706 ( SUSE ): 7.7 CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Affected Products:

         openSUSE Leap 16.0

-------------------------------------------------------------

An update that solves one vulnerability and has one bug fix can now be installed.

Description:

This update for mysql-connector-java fixes the following issues:

- Upgrade to Version 9.3.0
  - CVE-2025-30706: Fixed Connector/J vulnerability (bsc#1241693)
  - Updatable ResultSet fails with 'Parameter index out of range'.
  - Fixed Resultset UPDATE methods not checking validity of ResultSet.
  - DatabaseMetaData clean up.
  - Fixed implement missing methods in DatabaseMetaDataUsingInfoSchema.
  - Fixed procedure execution failing when the parameter name contains escape character.
  - Fixed allow only Krb5LoginModule in Kerberos authentication.
  - Fixed EXECUTE on CallableStatement resulting in ArrayIndexOutOfBoundsException.
  - Mysql connector use an uneffective way to match numericValue.
  - Fixed parameter index validation not proper in CallableStatement


Patch instructions:

   To install this openSUSE security update use the suse recommended installation methods
   like YaST online_update or "zypper patch".
   Alternatively you can run the command listed for your product:

- openSUSE Leap 16.0

   zypper in -t patch openSUSE-Leap-16.0-56=1

Package List:

- openSUSE Leap 16.0:

  mysql-connector-java-9.3.0-160000.1.1

References:

  * https://www.suse.com/security/cve/CVE-2025-30706.html