PostgreSQL Client Library Vulnerability: libpq Internal State Reset Flaw
Summary
ALPINE-CVE-2018-10915: A vulnerability was found in libpq, the default PostgreSQL client library where libpq failed to properly reset its internal state between connections. Affects postgresql versions < 10.5-r0. Fixed in 10.5-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL is a powerful, open-source relational database system that uses and extends the SQL language. It is known for its robustness, extensibility, and support for advanced data types. The libpq library is the default client library for PostgreSQL, enabling applications to connect and interact with PostgreSQL databases. However, a vulnerability has been identified in libpq that affects its internal state management, potentially compromising connection security.
Vulnerability Detail
A vulnerability was discovered in the libpq client library where it fails to properly reset its internal state between connections. This flaw can be exploited if an affected version of libpq is used with 'host' or 'hostaddr' connection parameters derived from untrusted input. Attackers could bypass client-side connection security features, gain access to higher privileged connections, or execute SQL injection attacks by causing the PQescape() functions to malfunction. This vulnerability affects PostgreSQL versions prior to 10.5, 9.6.10, 9.5.14, 9.4.19, and 9.3.24.
How To Fix
Minimum fixed version
10.5-r0
This is the first release that contains the fix.
sudo apk add --upgrade postgresqlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using untrusted input for 'host' or 'hostaddr' connection parameters. Implement strict input validation to ensure that only trusted sources are allowed to provide connection parameters.
Conclusion
In summary, a critical vulnerability in the libpq client library of PostgreSQL can lead to severe security risks if not addressed. Users are strongly advised to update to the latest patched versions and implement input validation as a temporary measure to mitigate risks.
See every vulnerability recorded for postgresql →
FAQ
PostgreSQL versions prior to 10.5, 9.6.10, 9.5.14, 9.4.19, and 9.3.24 are affected by this vulnerability.
The vulnerability can lead to bypassing client-side connection security, unauthorized access to higher privileged connections, and possible SQL injection attacks.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
If immediate updates are not possible, ensure to validate all input for connection parameters and avoid using untrusted sources.
References
Related vulnerabilities
Recent vulnerabilities recorded for postgresql.
