npgsql: CVE-2024-32655

Debian Bug report logs - #1070859
npgsql: CVE-2024-32655

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Moritz Mühlenhoff <jmm@inutil.org>

To: submit@bugs.debian.org

Subject: npgsql: CVE-2024-32655

Date: Fri, 10 May 2024 19:27:52 +0200

Source: npgsql
X-Debbugs-CC: team@security.debian.org
Severity: grave
Tags: security

Hi,

The following vulnerability was published for npgsql.

CVE-2024-32655[0]:
| Npgsql is the .NET data provider for PostgreSQL. The `WriteBind()`
| method in `src/Npgsql/Internal/NpgsqlConnector.FrontendMessages.cs`
| uses `int` variables to store the message length and the sum of
| parameter lengths. Both variables overflow when the sum of parameter
| lengths becomes too large. This causes Npgsql to write a message
| size that is too small when constructing a Postgres protocol message
| to send it over the network to the database. When parsing the
| message, the database will only read a small number of bytes and
| treat any following bytes as new messages while they belong to the
| old message. Attackers can abuse this to inject arbitrary Postgres
| protocol messages into the connection, leading to the execution of
| arbitrary SQL statements on the application's behalf. This
| vulnerability is fixed in 4.0.14, 4.1.13, 5.0.18, 6.0.11, 7.0.7, and
| 8.0.3.

https://github.com/npgsql/npgsql/security/advisories/GHSA-x9vc-6hfv-hg8c
https://github.com/npgsql/npgsql/commit/f7e7ead0702d776a8f551f5786c4cac2d65c4bc6


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2024-32655
    https://www.cve.org/CVERecord?id=CVE-2024-32655

Please adjust the affected versions in the BTS as needed.

Send a report that this bug log contains spam.