Upgrade MariaDB JDBC Driver to version 3.5.9 due to multiple 3rd-party Vulnerabilities

Current Situation

Currently JS7 JOC Cockpit ships with MariaDB JDBC Driver version 3.5.0. This version is affected by three vulnerabilities:

• CVE-2026-55856 - cleartext password disclosure to a MITM on the initial-handshake
• CVE-2026-55857 - Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials
• CVE-2026-55858 - Inappropriate Encoding for Output Context

We rate the impact of these vulnerabilities to our software as low. 

• CVE-2026-55856
  • can only occur if a Java application connects with sslMode=verify-full (or verify-ca) and uses untrusted/self-signed certificates
  • JS7 JOC Cockpit does not uses the sslMode in the java code nor does it ship with a hibernate configuration file with this mode preset
• CVE-2026-55857
  • can only occur if the environment JOC Cockpit runs in is not secured so that an attacker can occupy an on-path (MITM) position to be able to send an Authentication Switch Request for the dialog plugin
  • "Connections over properly verified TLS or a local Unix socket are not exposed to this vector."
• CVE-2026-55858
  • can only occur when an application like JOC Cockpit is running and continously accessing the database and at the same time the database servers character_set_client setting is changed mid-session.

We consider all three vulnerability issues to be "environmental based" rather than "application based".

Desired Behavior

JS7 JOC Cockpit should use MariaDB JDBC Driver version 3.5.9 where these vulnerabilities are fixed.

Workaround

Customers can download the JDBC Driver version 3.5.9 from the vendor and replace the version shipped with JS7 JOC Cockpit at any time (restart of JOC Cockpit needed).