Sensitive Information Exposure in Pgpool-II: ALPINE-CVE-2024-45624
Summary
ALPINE-CVE-2024-45624: Exposure of sensitive information due to incompatible policies issue exists in Pgpool-II. Affects pgpool versions < 4.5.4-r0. Fixed in 4.5.4-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pgpool-II is a middleware that works between PostgreSQL servers and a PostgreSQL database client. It provides features such as connection pooling, load balancing, and query caching to enhance database performance and reliability. However, a recent vulnerability has been identified that allows unauthorized access to sensitive data through its query cache.
Vulnerability Detail
The vulnerability, identified as ALPINE-CVE-2024-45624, arises from incompatible policies within Pgpool-II. This flaw allows a database user to access a query cache, potentially retrieving table data that they are not authorized to see. The implications of this vulnerability can lead to unauthorized data exposure, which could compromise sensitive information and violate data protection regulations.
How To Fix
Minimum fixed version
4.5.4-r0
This is the first release that contains the fix.
sudo apk add --upgrade pgpoolTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can restrict access to the query cache by implementing stricter access controls on database users and their permissions. This can help mitigate the risk of unauthorized data exposure until the package is updated.
Conclusion
The ALPINE-CVE-2024-45624 vulnerability in Pgpool-II poses a significant risk of sensitive information exposure. It is crucial for users to update to the patched version 4.5.4-r0 to safeguard against unauthorized data access. Additionally, implementing temporary workarounds can help mitigate risks until the update is applied.
See every vulnerability recorded for pgpool →
FAQ
It is a vulnerability in Pgpool-II that allows unauthorized access to sensitive data through its query cache.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The consequences include potential unauthorized access to sensitive information, which can lead to data breaches and compliance issues.
Yes, the patched version of Pgpool-II is 4.5.4-r0, which addresses this vulnerability.
If immediate updates are not possible, implement stricter access controls on database users to mitigate risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for pgpool.
