PostgreSQL Vulnerability: json_populate_recordset Function Crash and Memory Disclosure
Summary
ALPINE-CVE-2017-15098: Invalid json_populate_recordset or jsonb_populate_recordset function calls in PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, and 9.3.x before 9.3.20 can crash the server or dis... Affects postgresql versions < 10.1-r0. Fixed in 10.1-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL is a powerful, open-source relational database management system that uses and extends the SQL language. It is known for its robustness, extensibility, and support for advanced data types. However, certain versions of PostgreSQL are vulnerable to a specific issue in the json_populate_recordset and jsonb_populate_recordset functions, which can lead to server crashes or memory disclosure.
Vulnerability Detail
The vulnerability identified as CVE-2017-15098 affects PostgreSQL versions 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, and 9.3.x before 9.3.20. It arises from improper handling of function calls that can result in server crashes or the unintended disclosure of server memory. This vulnerability has a CVSS score of 8.1, indicating a high severity level, and poses significant risks to data integrity and availability.
How To Fix
Minimum fixed version
10.1-r0
This is the first release that contains the fix.
sudo apk add --upgrade postgresqlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the json_populate_recordset and jsonb_populate_recordset functions until the package is updated to a secure version. Additionally, restricting access to the database can help mitigate the risk of exploitation.
Conclusion
The vulnerability CVE-2017-15098 poses significant risks to PostgreSQL users, particularly in versions prior to the patched releases. It is crucial to update to the latest versions to mitigate the risks of server crashes and memory disclosure. Users are encouraged to monitor their systems for vulnerabilities using tools like Vulert, which can alert in real-time for open-source vulnerabilities.
See every vulnerability recorded for postgresql →
FAQ
CVE-2017-15098 is a vulnerability in PostgreSQL that affects certain versions and can lead to server crashes or memory disclosure.
Affected versions include PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, and 9.3.x before 9.3.20.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, consider restricting access to the database and avoiding the use of the vulnerable functions as a temporary measure.
The CVSS score of this vulnerability is 8.1, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for postgresql.
