Hi Paul,
Thank you for the detailed description of the problem.
Starting from the version 8.0.35 the Connector/ODBC 8.0.X is a special case where the ODBC driver is built only for Windows 32-bit platform. These versions of Connector/ODBC 8.0 do not have the new features introduced in 8.4/9.0/9.1. However, they contain all critical updates and security patches. This includes ODBC Driver 8.0.37.
The ODBC Driver 8.0.37 is using MySQL client library 8.0.37 for the network protocol communication with MySQL Server and therefore CVE-2023-6129 has to be assessed from this point of view.
As mentioned on this page:
https://www.oracle.com/security-alerts/cpuapr2024.html#AppendixMSQL
CVE-2023-6129 affects MySQL Server 8.0.36 and prior, 8.3.0 and prior.
Since 8.0.37 MySQL Server is not affected, the MySQL Connector/ODBC 8.0.37 is not affected as well.
I hope this answers your question.