CST-7217 Downloading MySQL Connector/J is vulnerable to MITM attacks

Description

In Liferay Portal 7.1.3, 7.2.1 and possibly earlier unsupported versions, the setup wizard will automatically download MySQL Connector/J if the selected database is MySQL. This download is done over a non-secure HTTP connection and is vulnerable to man in the middle (MITM) attacks.

Severity

Severity 2

Fixed Version(s)

Publication Date: 

六月 9, 2020

Found a Bug?

If you have found, or think you have found a bug, help us to help you by letting us know!

Found a Security Vulnerability?

There's a different process available if you have a security issue to report...

Hall of Fame!

Raise your profile - report security vulnerabilities and enter the Hall of Fame!