Skip to content

bug: upgrade mysql-connector-java to 8.0.13 (CVE-2018-3258) #435

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
devin-ai-integration wants to merge 1 commit into
base: master
Choose a base branch
from
Open

bug: upgrade mysql-connector-java to 8.0.13 (CVE-2018-3258) #435

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions UserFront/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,7 @@
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
<project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
<java.version>1.8</java.version>
<mysql.version>8.0.13</mysql.version>

@devin-ai-integration devin-ai-integration Bot Oct 12, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔴 Database startup fails in CEST

When MySQL reports CEST, the upgraded connector rejects spring.datasource.url without a serverTimezone setting. Database initialization fails, leaving the banking frontend unavailable.

Learn more

Connector/J 8.0.13 resolves the MySQL server's timezone when opening a connection. The configured datasource URL has no serverTimezone value. If the server reports an abbreviation such as CEST, this connector does not recognize it and rejects the connection. The application's JPA startup needs that connection, so the frontend cannot start in that deployment.

Example: A MySQL instance reports @@system_time_zone = CEST while the URL remains jdbc:mysql://localhost:3306/onlinebanking. Connector/J 8.0.13 rejects the connection rather than loading the banking accounts.

Recommended fix: Set serverTimezone to the deployment's correct IANA timezone in the datasource URL or ensure MySQL reports a recognized timezone. Verify connection startup against a server configured with an abbreviated timezone before deploying the upgrade.

Devin Review

Was this helpful? React with 👍 or 👎 to provide feedback.

@devin-ai-integration devin-ai-integration Bot Oct 12, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Confirmed. This is a known Connector/J 8.0.0–8.0.22 behaviour, and the PR description already flags it. I couldn't reproduce it here because the 8.0.13 jar isn't cached and Maven Central is blocked. The local MySQL 5.7 reports @@system_time_zone = UTC, so it isn't affected.

I've left the change as is because the correct fix depends on how this is deployed:

  1. Keep 8.0.13 and add ?serverTimezone=<IANA zone> to spring.datasource.url. This needs to be the zone the DB actually runs in. Hardcoding UTC would silently shift stored Dates on a non-UTC server. Under 5.1.x, by default, timestamps were sent without any conversion.
  2. Bump to 8.0.23+ instead. The default there is connectionTimeZone=LOCAL, which matches 5.1's no-conversion behaviour and doesn't fail on CEST. It goes past the "smallest fixing version" rule, though.

Maintainers: tell me which option you want and I'll push it.

</properties>

<dependencies>
Expand Down