The Patching Friars' AlmanacA calendar of CVE saints

Patron of April 30

BACKRONYMHoly card for backronym, generated with AI (Claude, Anthropic) for the Lunario dei Frati Patchatori.CC BY-NC-SA 4.0 --ssl ? BACKRONYM SSL AD LIBITUM
🤖 Image and text generated with AI

⬇ Download holy card: ·

Embed on your site

Saint BACKRONYM, Patron of Names With Logos

Patron of MySQL, options that look mandatory but are optional, and acronyms built backwards.

Life

On 30 April 2015 Adam Goodman of Duo Security revealed that in MySQL and MariaDB the --ssl option made encryption merely optional: a man in the middle could make the client fall back to a cleartext connection. To get noticed the flaw got a name, a website and a logo, with a deliberately absurd acronym: Bad Authentication Causes Kritical Risk Over Networks, Yikes MySQL. An affectionate parody of the branded-bug fashion.

Prayer

O Saint BACKRONYM, who reads names backwards, let our options mean what they say and never let encryption be an optional extra. Amen.

How to celebrate

Celebrated by updating MySQL, Connector/C and MariaDB, and requiring an encrypted connection instead of asking for one nicely.

Optional encryption, decorative protection.

Technical record

Disclosed on
April 30 2015
CVE
CVE-2015-3152

Oracle MySQL before 5.7.3, Oracle MySQL Connector/C (aka libmysqlclient) before 6.1.3, and MariaDB before 5.5.44 use the --ssl option to mean that SSL is optional, which allows man-in-the-middle attackers to spoof servers via a cleartext-downgrade attack, aka a "BACKRONYM" attack.

Sources: backronym.fail · web.archive.org

📅 Add to your calendar

SaintsGoogle CalendarApple, Outlook (.ics)

Observances (feasts, scourges and miracles)Google CalendarApple, Outlook (.ics)

In Google Calendar you can also paste the URL in Settings → Add calendar → From URL. The first sync can take a few hours.