Описание
Buffer over-read in PostgreSQL function pg_restore_attribute_stats() accepts array values of unmatched length, which causes query planning to read past end of one array. This allows a table maintainer to infer memory values past that array end. Within major version 18, minor versions before PostgreSQL 18.4 are affected. Versions before PostgreSQL 18 are unaffected.
A flaw was found in PostgreSQL. This buffer over-read vulnerability in the pg_restore_attribute_stats() function allows a table maintainer to infer memory values. By providing array values of unmatched length, a malicious table maintainer can cause query planning to read past the end of an array, leading to information disclosure.
Меры по смягчению последствий
To mitigate this information disclosure vulnerability, restrict network access to the PostgreSQL server to only trusted clients. Configure firewall rules to limit inbound connections to the PostgreSQL port (default 5432) from authorized hosts only. For example, using firewall-cmd on Red Hat Enterprise Linux:
sudo firewall-cmd --permanent --add-source=<TRUSTED_IP_ADDRESS>/32 --zone=public
sudo firewall-cmd --permanent --add-port=5432/tcp --zone=public
sudo firewall-cmd --reload
Alternatively, configure PostgreSQL to listen only on the localhost interface by setting listen_addresses = 'localhost' in postgresql.conf and restarting the PostgreSQL service.
sudo systemctl restart postgresql
This reduces the attack surface by preventing unauthorized network access to the database. Note that restarting the PostgreSQL service will temporarily interrupt database operations.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | postgresql16 | Not affected | ||
| Red Hat Enterprise Linux 6 | postgresql | Not affected | ||
| Red Hat Enterprise Linux 7 | postgresql | Not affected | ||
| Red Hat Enterprise Linux 8 | libpq | Not affected | ||
| Red Hat Enterprise Linux 8 | postgresql | Not affected | ||
| Red Hat Enterprise Linux 8 | postgresql-jdbc | Not affected | ||
| Red Hat Enterprise Linux 9 | postgresql | Not affected | ||
| Red Hat Enterprise Linux 9 | postgresql:15/postgresql | Not affected | ||
| Red Hat Enterprise Linux 9 | postgresql:16/postgresql | Not affected | ||
| Self-service automation portal 2 | ansible-automation-platform/bootc-automation-portal-rhel9 | Fix deferred |
Показывать по
Дополнительная информация
Статус:
4.3 Medium
CVSS3
Связанные уязвимости
Buffer over-read in PostgreSQL function pg_restore_attribute_stats() accepts array values of unmatched length, which causes query planning to read past end of one array. This allows a table maintainer to infer memory values past that array end. Within major version 18, minor versions before PostgreSQL 18.4 are affected. Versions before PostgreSQL 18 are unaffected.
Buffer over-read in PostgreSQL function pg_restore_attribute_stats() accepts array values of unmatched length, which causes query planning to read past end of one array. This allows a table maintainer to infer memory values past that array end. Within major version 18, minor versions before PostgreSQL 18.4 are affected. Versions before PostgreSQL 18 are unaffected.
Buffer over-read in PostgreSQL function pg_restore_attribute_stats() a ...
Buffer over-read in PostgreSQL function pg_restore_attribute_stats() accepts array values of unmatched length, which causes query planning to read past end of one array. This allows a table maintainer to infer memory values past that array end. Within major version 18, minor versions before PostgreSQL 18.4 are affected. Versions before PostgreSQL 18 are unaffected.
Уязвимость функции pg_restore_attribute_stats() системы управления базами данных PostgreSQL, позволяющая нарушителю раскрыть защищаемую информацию
4.3 Medium
CVSS3