Denial of Service Vulnerability in Virtuoso OpenSource Package
Summary
DEBIAN-CVE-2024-57637: An issue in the dfe_unit_gb_dependant component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. Affects virtuoso-opensource versions < 7.2.12+dfsg-0.2. Fixed in 7.2.12+dfsg-0.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Virtuoso OpenSource is a versatile and powerful open-source database engine that supports various data models, including RDF and SQL. It is widely used for applications requiring high-performance data storage and retrieval. However, the package has been found to have a vulnerability in the dfe_unit_gb_dependant component, which can be exploited to cause a Denial of Service (DoS). This vulnerability affects versions prior to 7.2.12+dfsg-0.2 in both Debian 13 and 14.
Vulnerability Detail
An issue in the dfe_unit_gb_dependant component of OpenLink Virtuoso OpenSource v7.2.11 allows attackers to execute crafted SQL statements that can lead to a Denial of Service (DoS). This vulnerability can be exploited by sending specially crafted SQL queries to the database, which may cause the service to become unresponsive, affecting the availability of applications relying on the database.
How To Fix
Minimum fixed version
7.2.12+dfsg-0.2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade virtuoso-opensourceTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not possible, consider restricting access to the database to trusted users only, and monitor SQL queries for any unusual activity that may indicate an attempted exploit.
Conclusion
The Denial of Service vulnerability in the Virtuoso OpenSource package poses a significant risk to applications relying on this database engine. It is crucial to update to the latest patched version to mitigate this risk. Users should also consider implementing workarounds until they can apply the necessary updates.
See every vulnerability recorded for virtuoso-opensource →
FAQ
The vulnerability allows attackers to exploit the dfe_unit_gb_dependant component to execute crafted SQL statements, leading to a Denial of Service.
Versions prior to 7.2.12+dfsg-0.2 are affected in both Debian 13 and 14.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
As a temporary measure, restrict database access to trusted users and monitor for unusual SQL query activity.
Detailed information can be found in the Debian CVE database at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2024-57637.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for virtuoso-opensource.
