Bug #58152 Option to hide server version

Description:
Displaying version number gives a cracker an opportunity to attack known security bugs if the version is old. Hiding version number may reduce opportunities to attack an security hole which is open in a certain version only.

How to repeat:
n/a

Suggested fix:
Please add an option like --blind-version or similar for mysqld.

Can't the cracker just attempt to use the exploit?

Davi,

Yeah, you're right. By hiding version information, an attacker must guess whether an exploit. This will cause some failed attempts to attack the server, then logs may give the defender a chance to block an attacker.

I believe an unauthenticated user should not need to know the exact version.  They should know just enough to get authenticated, but not more.

"telnet <IP> 3306" will give it to any host that is allowed.

I guess it's okay for an authenticated user to see the version via SELECT VERSION().

Hi Dev team，any plan to fix this problem ？

Hi Dev team，any plan to fix this problem ？