CGA-vmcg-54pm-cp7r

Published 9 months ago

Last updated 8 months ago

Package

vault-fips-1.14

Latest Update
Affected

Severity

9.8

Critical

CVSS V3

Summary

pgproto3 SQL Injection via Protocol Message Size Overflow

Description

Impact

SQL injection can occur if an attacker can cause a single query or bind message to exceed 4 GB in size. An integer overflow in the calculated message size can cause the one large message to be sent as multiple messages under the attacker's control.

Patches

The problem is resolved in v2.3.3

Workarounds

Reject user input large enough to cause a single query or bind message to exceed 4 GB in size.

Updates

Status
Fixed version
Impact
Updated
Affected
—
A govulncheck analysis found several affected symbols in the APK.

May 05, 2024

Fixed
1.14.10-r0
—

Mar 26, 2024

2 updates