Mario Heiderich, Cure53 Bielefelder Str. 14 D 10709 Berlin cure53.de · mario@cure53.de Pentest-Report Vitess 02.2019 Cure53, Dr.-Ing. M. Heiderich, M. Wege, MSc. N. Krein, MSc Mario Heiderich, Cure53 Bielefelder Str. 14 D 10709 Berlin cure53.de · mario@cure53.de dedicated instant messaging channel was used for arising questions and further Mario Heiderich, Cure53 Bielefelder Str. 14 D 10709 Berlin cure53.de · mario@cure53.de Test Methodology This section describes the methodology that was used during this source

pods NAME READY STATUS RESTARTS AGE example -etcd-faf13de3 -1 1/1 Running 0 78s example -etcd-faf13de3 -2 1/1 Running 0 78s example -etcd-faf13de3 -3 1/1 Running 0 78s example -vttablet -zone1 -2469782763-bfadd780 front-end application queries onto a pool of MySQL connections to optimize perfor- mance. – Query de-duping – Reuse results of an in-flight query for any identical requests received while the in-flight pods NAME READY STATUS RESTARTS AGE example -etcd-faf13de3 -1 1/1 Running 0 8m11s example -etcd-faf13de3 -2 1/1 Running 0 8m11s example -etcd-faf13de3 -3 1/1 Running 0 8m11s example -vttablet -zone1 -1250593518-17c58396

pods NAME READY STATUS RESTARTS AGE example -etcd-faf13de3 -1 1/1 Running 0 78s example -etcd-faf13de3 -2 1/1 Running 0 78s example -etcd-faf13de3 -3 1/1 Running 0 78s example -vttablet -zone1 -2469782763-bfadd780 front-end application queries onto a pool of MySQL connections to optimize perfor- mance. – Query de-duping – Reuse results of an in-flight query for any identical requests received while the in-flight ------+ | 2 | corder_lookup_vdx | keyspace:"customer" shard:"-80" | MySQL56/68da1cdd-dd03 -11ea-95de-68a86d2718b0:1-43 | | 9223372036854775807 | 9223372036854775807 | | RDONLY | 1597282811 | 0 | Stopped

pods NAME READY STATUS RESTARTS AGE example -etcd-faf13de3 -1 1/1 Running 0 78s example -etcd-faf13de3 -2 1/1 Running 0 78s example -etcd-faf13de3 -3 1/1 Running 0 78s example -vttablet -zone1 -2469782763-bfadd780 front-end application queries onto a pool of MySQL connections to optimize perfor- mance. – Query de-duping – Reuse results of an in-flight query for any identical requests received while the in-flight ------+ | 2 | corder_lookup_vdx | keyspace:"customer" shard:"-80" | MySQL56/68da1cdd-dd03 -11ea-95de-68a86d2718b0:1-43 | | 9223372036854775807 | 9223372036854775807 | | RDONLY | 1597282811 | 0 | Stopped

pods NAME READY STATUS RESTARTS AGE example -etcd-faf13de3 -1 1/1 Running 0 78s example -etcd-faf13de3 -2 1/1 Running 0 78s example -etcd-faf13de3 -3 1/1 Running 0 78s example -vttablet -zone1 -2469782763-bfadd780 front-end application queries onto a pool of MySQL connections to optimize perfor- mance. – Query de-duping – Reuse results of an in-flight query for any identical requests received while the in-flight ------+ | 2 | corder_lookup_vdx | keyspace:"customer" shard:"-80" | MySQL56/68da1cdd-dd03 -11ea-95de-68a86d2718b0:1-43 | | 9223372036854775807 | 9223372036854775807 | | RDONLY | 1597282811 | 0 | Stopped

pods NAME READY STATUS RESTARTS AGE example -etcd-faf13de3 -1 1/1 Running 0 78s example -etcd-faf13de3 -2 1/1 Running 0 78s example -etcd-faf13de3 -3 1/1 Running 0 78s example -vttablet -zone1 -2469782763-bfadd780 front-end application queries onto a pool of MySQL connections to optimize perfor- mance. – Query de-duping – Reuse results of an in-flight query for any identical requests received while the in-flight ------+ | 2 | corder_lookup_vdx | keyspace:"customer" shard:"-80" | MySQL56/68da1cdd-dd03 -11ea-95de-68a86d2718b0:1-43 | | 9223372036854775807 | 9223372036854775807 | | RDONLY | 1597282811 | 0 | Stopped

pods NAME READY STATUS RESTARTS AGE example -etcd-faf13de3 -1 1/1 Running 0 78s example -etcd-faf13de3 -2 1/1 Running 0 78s example -etcd-faf13de3 -3 1/1 Running 0 78s example -vttablet -zone1 -2469782763-bfadd780 front-end application queries onto a pool of MySQL connections to optimize perfor- mance. – Query de-duping – Reuse results of an in-flight query for any identical requests received while the in-flight ------+ | 2 | corder_lookup_vdx | keyspace:"customer" shard:"-80" | MySQL56/68da1cdd-dd03 -11ea-95de-68a86d2718b0:1-43 | | 9223372036854775807 | 9223372036854775807 | | RDONLY | 1597282811 | 0 | Stopped

pass a value that could traverse the storage. https://github.com/vitessio/vitess/blob/aa87bc4e9f05e3de3955e9641799eca9114d83bb/g o/vt/vtctl/grpcvtctldserver/server.go#L1161 func (s *VtctldServer) GetBackups(ctx

front-end application queries onto a pool of MySQL connections to optimize perfor- mance. – Query de-duping – Reuse results of an in-flight query for any identical requests received while the in-flight

front-end application queries onto a pool of MySQL connections to optimize perfor- mance. – Query de-duping – Reuse results of an in-flight query for any identical requests received while the in-flight