CVE-2024-21272: Oracle MySQL Connector/Python RCE Flaw

CVE-2024-21272 Overview

CVE-2024-21272 is a vulnerability in the Oracle MySQL Connectors product, specifically the Connector/Python component. Supported versions 9.0.0 and prior are affected. A low-privileged attacker with network access via multiple protocols can compromise MySQL Connectors, resulting in full takeover of the connector. The flaw impacts confidentiality, integrity, and availability. Oracle addressed the issue in the October 2024 Critical Patch Update. The vulnerability is mapped to [CWE-306] (Missing Authentication for Critical Function).

Critical Impact
Successful exploitation results in takeover of MySQL Connectors, allowing an attacker to compromise the confidentiality, integrity, and availability of connector operations.

Affected Products

Oracle MySQL Connectors 9.0.0
Oracle MySQL Connectors prior to 9.0.0
Oracle MySQL Connector/Python (all supported versions ≤ 9.0.0)

Discovery Timeline

2024-10-15 - Oracle publishes the October 2024 Critical Patch Update addressing CVE-2024-21272
2024-10-15 - CVE-2024-21272 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-21272

Vulnerability Analysis

The vulnerability resides in Oracle MySQL Connector/Python, a client library that applications use to communicate with MySQL database servers. An attacker with low privileges and network access can exploit weaknesses in the connector to fully compromise it. Oracle classifies the attack complexity as high, meaning successful exploitation depends on conditions outside the attacker's direct control. Despite that complexity, the impact spans confidentiality, integrity, and availability of the connector.

The CWE mapping to [CWE-306] indicates the connector fails to enforce authentication for a critical function during protocol handling. An attacker positioned to interact with the connector over one of several supported protocols can leverage this gap to take control of connector operations, including data flowing between the application and the MySQL server.

Root Cause

The root cause is missing authentication for a critical function ([CWE-306]) within the Connector/Python communication path. The connector processes protocol messages without adequately verifying the peer's authenticity, permitting a network-adjacent attacker to influence connector state and behavior. Oracle has not published deeper technical detail beyond the Critical Patch Update advisory.

Attack Vector

Exploitation requires network access and low privileges. The attacker must interact with the Connector/Python instance over one of multiple supported protocols. No user interaction is required. Because attack complexity is high, the attacker likely needs to influence or observe timing, ordering, or session state to achieve takeover. Successful exploitation yields high impact on confidentiality, integrity, and availability of the connector.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Oracle Critical Patch Update Advisory - October 2024 for vendor guidance.

Detection Methods for CVE-2024-21272

Indicators of Compromise

Unexpected MySQL Connector/Python versions (9.0.0 or earlier) reported by software inventory tools
Anomalous outbound connections from application hosts running Python-based MySQL clients to untrusted endpoints
Unexpected changes in query patterns, result sets, or authentication attempts originating from applications that use Connector/Python

Detection Strategies

Inventory Python environments across servers and developer workstations using pip list or SBOM tooling to identify mysql-connector-python versions ≤ 9.0.0
Monitor network traffic between application servers and MySQL databases for unexpected peers, protocol anomalies, or TLS downgrade attempts
Correlate application logs with database audit logs to detect discrepancies that could indicate connector-layer tampering

Monitoring Recommendations

Enable MySQL server-side audit logging and forward events to a centralized SIEM for correlation
Track process-level telemetry on hosts that import mysql.connector to detect abnormal child processes or network activity
Alert on outbound connections from application hosts to MySQL endpoints that fall outside the approved allow-list

How to Mitigate CVE-2024-21272

Immediate Actions Required

Upgrade Oracle MySQL Connector/Python to the version released in the October 2024 Critical Patch Update or later
Identify all applications and containers bundling mysql-connector-python ≤ 9.0.0 and prioritize patching
Restrict network paths between application hosts and MySQL servers to trusted segments using firewall or micro-segmentation controls
Enforce TLS for all MySQL client-server connections and validate server certificates

Patch Information

Oracle addressed CVE-2024-21272 in the Oracle Critical Patch Update Advisory - October 2024. Administrators should upgrade mysql-connector-python to a version later than 9.0.0. Verify the installed version with pip show mysql-connector-python and update using the standard package manager.

Workarounds

Restrict MySQL client-server communication to isolated network segments where only trusted endpoints can reach the database
Require mutual TLS between application hosts and MySQL servers to reduce exposure to network-based attackers
Run applications that use Connector/Python under least-privilege service accounts to limit blast radius if the connector is compromised

bash

# Verify and upgrade Connector/Python
pip show mysql-connector-python
pip install --upgrade "mysql-connector-python>9.0.0"

# Enforce TLS in application connection configuration
# Example (Python):
#   import mysql.connector
#   cnx = mysql.connector.connect(
#       host="db.internal",
#       user="app",
#       password="***",
#       ssl_ca="/etc/ssl/certs/mysql-ca.pem",
#       ssl_verify_cert=True,
#       ssl_verify_identity=True,
#   )