Описание
Firebird is an open-source relational database management system. In versions FB3 of the client library placed incorrect data length values into XSQLDA fields when communicating with FB4 or higher servers, resulting in an information leak. This issue is fixed by upgrading to the FB4 client or higher.
A flaw was found in the Firebird client library. When an older version of the client library communicates with newer Firebird servers, it places incorrect data length values into XSQLDA fields. This vulnerability can lead to an information leak, potentially exposing sensitive data.
Отчет
An Important severity information leak was found in the Firebird client library. When a Firebird 3 (FB3) client communicates with a Firebird 4 or later server, the client library places incorrect data length values into XSQLDA fields, which can result in the disclosure of potentially sensitive information during network client-server communication. Red Hat Product Security has rated this flaw Important (CVSS 7.7, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) based on a network attack vector requiring only low privileges, with a scope change and high confidentiality impact. This differs from the CVEORG score of 7.9, which is based on a local attack vector with high integrity and availability impacts that the available technical evidence does not support; the evidence describes a confidentiality-only information leak. Within the Red Hat portfolio, this flaw affects only community products: the firebird component in Fedora and EPEL is in scope, and no Red Hat Enterprise Linux products are tracked for this issue.
Меры по смягчению последствий
The information leak occurs only when a Firebird 3 (FB3) client library connects to a Firebird 4 or later server. As a workaround, avoid this combination by restricting Firebird 3 clients to Firebird 3 servers until the client library can be updated. The upstream resolution is to upgrade the Firebird client library to the Firebird 4 client or higher.
Дополнительная информация
Статус:
EPSS
7.7 High
CVSS3
Связанные уязвимости
Firebird is an open-source relational database management system. In versions FB3 of the client library placed incorrect data length values into XSQLDA fields when communicating with FB4 or higher servers, resulting in an information leak. This issue is fixed by upgrading to the FB4 client or higher.
Firebird is an open-source relational database management system. In versions FB3 of the client library placed incorrect data length values into XSQLDA fields when communicating with FB4 or higher servers, resulting in an information leak. This issue is fixed by upgrading to the FB4 client or higher.
Firebird is an open-source relational database management system. In v ...
EPSS
7.7 High
CVSS3