keyspaces” and “ADA-VIT-SA23-12, VTAdmin users that can create shards can deny access to other functions”. These two issues allowed a malicious user to create a resource that would then subsequently disallow k8stopo Low No 12 ADA-VIT-SA23-12 VTAdmin users that can create shards can deny access to other functions Moderate Yes 16 Vitess Security Audit, 2023 ADA-VIT-SA23-1: Missing documentation on deploying Informational Fixed Yes Vitess uses insecure hashing functions in a number of places across different packages. Usage of insecure hashing functions should be justified, and preferably in the code where

. . . . 46 Locking functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 Locking Functions 46 Functions covered . . . . . . of some column in your data, such as the user ID. Vitess allows you to choose from a variety of functions (vindexes) to perform this mapping. This allows you to choose the right one to achieve optimal distribution value can be changed by using the vtgate flag -mysql_server_version. Special functions There are a few special functions that Vitess handles without delegating to MySQL. • DATABASE() - The keyspace name

. . . . 42 Locking functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44 Locking Functions 44 Functions covered . . . . . . of some column in your data, such as the user ID. Vitess allows you to choose from a variety of functions (vindexes) to perform this mapping. This allows you to choose the right one to achieve optimal distribution value can be changed by using the vtgate flag -mysql_server_version. 21 Special functions There are a few special functions that Vitess handles without delegating to MySQL. • DATABASE() - The keyspace name

. . . . 41 Locking functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43 Locking Functions 43 Functions covered . . . . . . of some column in your data, such as the user ID. Vitess allows you to choose from a variety of functions (vindexes) to perform this mapping. This allows you to choose the right one to achieve optimal distribution application will set it to, and Vitess can use connection pooling. 20 Special functions There are a few special functions that Vitess handles without delegating to MySQL. • DATABASE() - The keyspace name

. . . . . . . 53 Locking functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 Locking Functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54 Functions covered . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . of some column in your data, such as the user ID. Vitess allows you to choose from a variety of functions (vindexes) to perform this mapping. This allows you to choose the right one to achieve optimal distribution

of some column in your data, such as the user ID. Vitess allows you to choose from a variety of functions (vindexes) to perform this mapping. This allows you to choose the right one to achieve optimal distribution Therefore FFFF will be out of the 80-FF range. 80- means: ‘anything greater than or equal to 0x80 A hash vindex produces an 8-byte number. This means that all numbers less than 0x8000000000000000 will fall arbitrary length. However, the most significant bits are the ones on the left. For example an md5 hash produces 16 bytes. That can also be used as a keyspace id. A varbinary of arbitrary length can also

of some column in your data, such as the user ID. Vitess allows you to choose from a variety of functions (vindexes) to perform this mapping. This allows you to choose the right one to achieve optimal distribution allowed to lag far behind the master because replication needs to be stopped to perform some of these functions. In our use case, we are provisioning one rdonly replica per shard in order to perform resharding { "sharded": true, "vindexes": { "hash": { "type": "hash" } }, "tables": { 33 "customer": { "column_vindexes": [ { "column": "customer_id", "name": "hash" } ], "auto_increment": { "column":

locations can be supported. The byte value of the country(or other location identifier) is prefixed to a hash value computed from the id to produce the keyspace_id. The lookup table is used to store the id to of some column in your data, such as the user ID. Vitess allows you to choose from a variety of functions (vindexes) to perform this mapping. This allows you to choose the right one to achieve optimal distribution the application will set it to, and Vitess can use connection pooling. Special functions There are a few special functions that Vitess handles without delegating to MySQL. • DATABASE() - The keyspace name

of some column in your data, such as the user ID. Vitess allows you to choose from a variety of functions (vindexes) to perform this mapping. This allows you to choose the right one to achieve optimal distribution Therefore FFFF will be out of the 80-FF range. 80- means: ‘anything greater than or equal to 0x80 A hash vindex produces an 8-byte number. This means that all numbers less than 0x8000000000000000 will fall arbitrary length. However, the most significant bits are the ones on the left. For example an md5 hash produces 16 bytes. That can also be used as a keyspace id. A varbinary of arbitrary length can also

exposed by vtlctld and the same functions that are also reachable via vtctlclient. • Despite this being only an administrative functionality, a typical example for such functions interacting with the file system The MySQL authentication uses hashing and a salt in order to prevent authenticating with only a hash or replaying a previously recorded authentication request. The authentication protocol can Server computes: sha1(client_response ^ sha1(salt + sha1(sha1(pw))) Server compares: generated_hash == stored_hash In case the password is stored as plain-text, Vitess spares itself the final SHA1 operation