REDHAT-BUG-2477442: High severity PostgreSQL postgresql vulnerability
Use of inherently dangerous function PQfn(..., resultisint=0, ...) in PostgreSQL libpq loexport(), loread(), lolseek64(), and lotell64() functions allows the server superuser to overwrite a client stack buffer with an arbitrarily-large response. Like gets(), PQfn(..., resultisint=0, ...) stores arbitrary-length, server-determined data into a buffer of unspecified size. Because both the \loexport command in psql and pgdump call loread(), the server superuser can overwrite pgdump or psql stack memory. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.4 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 17.10 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.14 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.18 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 14.23
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2477442?
The severity of REDHAT-BUG-2477442 is high (7).
How do I fix REDHAT-BUG-2477442?
To fix REDHAT-BUG-2477442, it is recommended to update your PostgreSQL installation to the latest patched version.
What functions are affected by REDHAT-BUG-2477442?
The functions affected by REDHAT-BUG-2477442 are lo_export(), lo_read(), lo_lseek64(), and lo_tell64() in PostgreSQL libpq.
What is the risk associated with REDHAT-BUG-2477442?
The risk associated with REDHAT-BUG-2477442 includes the potential for a server superuser to overwrite a client stack buffer.
Who is affected by REDHAT-BUG-2477442?
Users of PostgreSQL who utilize the affected functions may be vulnerable to exploitation due to REDHAT-BUG-2477442.