Similarly, MySQL Connector/J also used to attempt to deserialize binary data tha...

xnyhps on Jan 20, 2019 | parent | context | favorite | on: MySQL client allows MySQL server to request any lo...

Similarly, MySQL Connector/J also used to attempt to deserialize binary data that looked like a serialized Java object (CVE-2017-3523). Doing this with untrusted data can often be used to obtain arbitrary code execution. Connecting to an untrusted server does not appear to be a use-case that received enough attention.