Skip to content

bug(security): upgrade mysql-connector-java 5.1.42 -> 8.0.16 (CVE-2019-2692) #573

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
devin-ai-integration wants to merge 1 commit into
base: master
Choose a base branch
from
Open

bug(security): upgrade mysql-connector-java 5.1.42 -> 8.0.16 (CVE-2019-2692) #573

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions UserFront/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,7 @@
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
<project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
<java.version>1.8</java.version>
<mysql.version>8.0.16</mysql.version>

@devin-ai-integration devin-ai-integration Bot Oct 12, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔴 Database startup fails in some time zones

When MySQL reports CEST, mysql.version 8.0.16 rejects the connection without an explicit time zone. The configured JDBC URL supplies none, so the application fails to start.

Learn more

Connector/J 8.0.16 cannot map some server-reported time-zone abbreviations to Java time zones. The application's JDBC URL has no serverTimezone parameter, so a MySQL server reporting an abbreviation such as CEST can prevent datasource initialization during startup. This affects deployments using those server settings; UTC servers do not trigger this failure.

Example: A deployment connects to MySQL reporting CEST. Connector/J rejects that abbreviation during connection setup, and the banking application never finishes starting. With a recognized time zone specified in the JDBC URL, the connection can initialize.

Recommended fix: Provide a recognized serverTimezone value through the JDBC URL in application properties, selecting the actual database time zone rather than hard-coding UTC for servers in another zone. Verify startup against a server configured to report CEST.

Devin Review

Was this helpful? React with 👍 or 👎 to provide feedback.

@devin-ai-integration devin-ai-integration Bot Oct 12, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Agreed that this can happen: Connector/J 8.0.16–8.0.22 rejects time-zone abbreviations it can't map (e.g. CEST). The PR description already calls this out as a review note.

I left serverTimezone out of this PR on purpose:

  • The right value depends on how the target MySQL server is configured, and the repo doesn't record that. The local MySQL 5.7 I tested against reports SYSTEM/UTC, which works.
  • Hard-coding serverTimezone=UTC would convert timestamps wrongly on a server that actually runs in another zone.
  • The remediation guidance asks for the minimal bump.

If you know the deployed server's zone, I'll add ?serverTimezone=<zone> to spring.datasource.url. Moving up to 8.0.23+ would also avoid the hard failure, but that's no longer the smallest fixing version.

</properties>

<dependencies>
Expand All @@ -48,6 +49,12 @@
<dependency>
<groupId>mysql</groupId>
<artifactId>mysql-connector-java</artifactId>
<exclusions>
<exclusion>
<groupId>com.google.protobuf</groupId>
<artifactId>protobuf-java</artifactId>
</exclusion>
</exclusions>
</dependency>

<dependency>
Expand Down