<?xml version="1.0" encoding="UTF-8"?>
<cvrfdoc xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:cvrf="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf" xmlns:cvrf-common="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/common" xmlns:cvssv2="http://scap.nist.gov/schema/cvss-v2/1.0" xmlns:cvssv3="https://www.first.org/cvss/cvss-v3.0.xsd" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:ns0="http://purl.org/dc/elements/1.1/" xmlns:prod="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod" xmlns:scap-core="http://scap.nist.gov/schema/scap-core/1.0" xmlns:sch="http://purl.oclc.org/dsdl/schematron" xmlns:vuln="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf">
  <DocumentTitle xml:lang="en">CVE-2018-3258</DocumentTitle>
  <DocumentType>SUSE CVE</DocumentType>
  <DocumentPublisher Type="Vendor">
    <ContactDetails>security@suse.de</ContactDetails>
    <IssuingAuthority>SUSE Security Team</IssuingAuthority>
  </DocumentPublisher>
  <DocumentTracking>
    <Identification>
      <ID>SUSE CVE-2018-3258</ID>
    </Identification>
    <Status>Interim</Status>
    <Version>1</Version>
    <RevisionHistory>
      <Revision>
        <Number>9</Number>
        <Date>2025-10-05T02:05:37Z</Date>
        <Description>current</Description>
      </Revision>
    </RevisionHistory>
    <InitialReleaseDate>2021-05-30T14:08:03Z</InitialReleaseDate>
    <CurrentReleaseDate>2025-10-05T02:05:37Z</CurrentReleaseDate>
    <Generator>
      <Engine>cve-database/bin/generate-cvrf-cve.pl</Engine>
      <Date>2020-12-27T01:00:00Z</Date>
    </Generator>
  </DocumentTracking>
  <DocumentNotes>
    <Note Title="CVE" Type="Summary" Ordinal="1" xml:lang="en">CVE-2018-3258</Note>
    <Note Title="Mitre CVE Description" Type="Description" Ordinal="2" xml:lang="en">Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/J). Supported versions that are affected are 8.0.12 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).</Note>
    <Note Title="Terms of Use" Type="Legal Disclaimer" Ordinal="4" xml:lang="en">The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).</Note>
  </DocumentNotes>
  <DocumentReferences>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/security/rating/</URL>
      <Description>SUSE Security Ratings</Description>
    </Reference>
  </DocumentReferences>
  <ProductTree xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod">
    <Branch Type="Product Family" Name="HPE Helion OpenStack 8">
      <Branch Type="Product Name" Name="HPE Helion OpenStack 8">
        <FullProductName ProductID="HPE Helion OpenStack 8" CPE="cpe:/o:suse:hpe-helion-openstack:8">HPE Helion OpenStack 8</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Desktop 11 SP4">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Software Development Kit 11 SP4">
        <FullProductName ProductID="SUSE Linux Enterprise Software Development Kit 11 SP4" CPE="cpe:/a:suse:sle-sdk:11:sp4">SUSE Linux Enterprise Software Development Kit 11 SP4</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Desktop 12 SP3">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Software Development Kit 12 SP3">
        <FullProductName ProductID="SUSE Linux Enterprise Software Development Kit 12 SP3" CPE="cpe:/o:suse:sle-sdk:12:sp3">SUSE Linux Enterprise Software Development Kit 12 SP3</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Server 11 SP4">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Software Development Kit 11 SP4">
        <FullProductName ProductID="SUSE Linux Enterprise Software Development Kit 11 SP4" CPE="cpe:/a:suse:sle-sdk:11:sp4">SUSE Linux Enterprise Software Development Kit 11 SP4</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Server 12 SP3">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Software Development Kit 12 SP3">
        <FullProductName ProductID="SUSE Linux Enterprise Software Development Kit 12 SP3" CPE="cpe:/o:suse:sle-sdk:12:sp3">SUSE Linux Enterprise Software Development Kit 12 SP3</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Server for SAP Applications 11 SP4">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Software Development Kit 11 SP4">
        <FullProductName ProductID="SUSE Linux Enterprise Software Development Kit 11 SP4" CPE="cpe:/a:suse:sle-sdk:11:sp4">SUSE Linux Enterprise Software Development Kit 11 SP4</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Server for SAP Applications 12 SP3">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Software Development Kit 12 SP3">
        <FullProductName ProductID="SUSE Linux Enterprise Software Development Kit 12 SP3" CPE="cpe:/o:suse:sle-sdk:12:sp3">SUSE Linux Enterprise Software Development Kit 12 SP3</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE OpenStack Cloud 8">
      <Branch Type="Product Name" Name="SUSE OpenStack Cloud 8">
        <FullProductName ProductID="SUSE OpenStack Cloud 8" CPE="cpe:/o:suse:suse-openstack-cloud:8">SUSE OpenStack Cloud 8</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE OpenStack Cloud Crowbar 8">
      <Branch Type="Product Name" Name="SUSE OpenStack Cloud Crowbar 8">
        <FullProductName ProductID="SUSE OpenStack Cloud Crowbar 8" CPE="cpe:/o:suse:suse-openstack-cloud-crowbar:8">SUSE OpenStack Cloud Crowbar 8</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Version" Name="mysql-connector-java">
      <FullProductName ProductID="mysql-connector-java" CPE="cpe:2.3:a:oracle:mysql_connector/j:*:*:*:*:*:*:*:*">mysql-connector-java</FullProductName>
    </Branch>
    <Relationship ProductReference="mysql-connector-java" RelationType="Default Component Of" RelatesToProductReference="HPE Helion OpenStack 8">
      <FullProductName ProductID="HPE Helion OpenStack 8:mysql-connector-java">mysql-connector-java as a component of HPE Helion OpenStack 8</FullProductName>
    </Relationship>
    <Relationship ProductReference="mysql-connector-java" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Software Development Kit 11 SP4">
      <FullProductName ProductID="SUSE Linux Enterprise Software Development Kit 11 SP4:mysql-connector-java">mysql-connector-java as a component of SUSE Linux Enterprise Software Development Kit 11 SP4</FullProductName>
    </Relationship>
    <Relationship ProductReference="mysql-connector-java" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Software Development Kit 12 SP3">
      <FullProductName ProductID="SUSE Linux Enterprise Software Development Kit 12 SP3:mysql-connector-java">mysql-connector-java as a component of SUSE Linux Enterprise Software Development Kit 12 SP3</FullProductName>
    </Relationship>
    <Relationship ProductReference="mysql-connector-java" RelationType="Default Component Of" RelatesToProductReference="SUSE OpenStack Cloud 8">
      <FullProductName ProductID="SUSE OpenStack Cloud 8:mysql-connector-java">mysql-connector-java as a component of SUSE OpenStack Cloud 8</FullProductName>
    </Relationship>
    <Relationship ProductReference="mysql-connector-java" RelationType="Default Component Of" RelatesToProductReference="SUSE OpenStack Cloud Crowbar 8">
      <FullProductName ProductID="SUSE OpenStack Cloud Crowbar 8:mysql-connector-java">mysql-connector-java as a component of SUSE OpenStack Cloud Crowbar 8</FullProductName>
    </Relationship>
  </ProductTree>
  <Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="1">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/J). Supported versions that are affected are 8.0.12 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).</Note>
    </Notes>
    <CVE>CVE-2018-3258</CVE>
    <ProductStatuses>
      <Status Type="Known Not Affected">
        <ProductID>HPE Helion OpenStack 8:mysql-connector-java</ProductID>
        <ProductID>SUSE Linux Enterprise Software Development Kit 11 SP4:mysql-connector-java</ProductID>
        <ProductID>SUSE Linux Enterprise Software Development Kit 12 SP3:mysql-connector-java</ProductID>
        <ProductID>SUSE OpenStack Cloud 8:mysql-connector-java</ProductID>
        <ProductID>SUSE OpenStack Cloud Crowbar 8:mysql-connector-java</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>6.5</BaseScoreV2>
        <VectorV2>AV:N/AC:L/Au:S/C:P/I:P/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>8.8</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
  </Vulnerability>
</cvrfdoc>
