Buffer Over-Read Vulnerability in PostgreSQL dict_int

Executive Summary

This is a buffer over-read vulnerability in PostgreSQL's dict_int extension. It allows a database user to read portions of server memory by sending a zero-length token. The issue affects PostgreSQL versions before 18.7, 17.12, 16.16, 15.20, and 14.25.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check the PostgreSQL version running on your system. Compare it against the affected versions (before 18.7, 17.12, 16.16, 15.20, and 14.25). Use commands like 'psql --version' or 'SELECT version();' to verify the version. If using dict_int extension, review its configuration for unusual activity.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability may allow an authenticated user to disclose sensitive server memory contents. This could lead to exposure of confidential data, though it does not directly impact system integrity or availability.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update PostgreSQL to a patched version (18.7 or later, 17.12 or later, 16.16 or later, 15.20 or later, 14.25 or later). Disable the dict_int extension if not required. Restrict database user permissions to limit access to sensitive data.

Useful 0 Not Useful 0