STIGQter STIGQter: STIG Summary: Oracle MySQL 8.0 Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 28 Jan 2021:

The MySQL Database Server 8.0 and associated applications must reserve the use of dynamic code execution for situations that require it.

DISA Rule

SV-235157r638812_rule

Vulnerability Number

V-235157

Group Title

SRG-APP-000251-DB-000391

Rule Version

MYS8-00-007400

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Where dynamic code execution is employed in circumstances where the objective could practically be satisfied by static execution with strongly typed parameters, modify the code to do so.

Check Contents

Review MySQL source code (trigger procedures, functions) and application source code, to identify cases of dynamic code execution. Any user input should be handled through prepared statements or calls that bind parameters versus generating SQL.

If dynamic code execution is employed in circumstances where the objective could practically be satisfied by static execution with strongly typed parameters, this is a finding.

Vulnerability Number

V-235157

Documentable

False

Rule Version

MYS8-00-007400

Severity Override Guidance

Review MySQL source code (trigger procedures, functions) and application source code, to identify cases of dynamic code execution. Any user input should be handled through prepared statements or calls that bind parameters versus generating SQL.

If dynamic code execution is employed in circumstances where the objective could practically be satisfied by static execution with strongly typed parameters, this is a finding.

Check Content Reference

M

Target Key

5277

Comments