Paul Kehrer

The issue is related to the functions `EVP CipherUpdate`, `EVP EncryptUpdate`, and `EVP DecryptUpdate` in OpenSSL, which may overflow the output length argument when the input length is close to the maximum permissible length for an integer on the platform. This could cause applications to behave incorrectly or crash. The problem is due to an integer overflow, which can lead to a negative output length value, even though the function call returns a success indicator.

The issue arises from improper verification of the server hostname against the domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate. This allows man-in-the-middle attackers to spoof SSL servers via a specific string in a certificate field. The vulnerability can be exploited by a high-privileged attacker with network access to compromise the MySQL Server, potentially leading to a denial-of-service (DOS) condition where the server hangs or crashes repeatedly.

The issue concerns the Data Security component's failure to check the basicConstraints parameter during the validation of X.509 certificate chains. This allows man-in-the-middle attackers to spoof an SSL server by using a non-CA certificate to sign a certificate for an arbitrary domain.