CVE-2012-4575: Buffer Overflow
A denial of service flaw was found in the way pgbouncer, a lightweight connection pooler for PostgreSQL, performed processing of client requests attempting to add new database(s) with large name(s). A remote attacker could use this flaw to cause pooler server shutdown.
Relevant upstream patch: [1] http://git.postgresql.org/gitweb/?p=pgbouncer.git;a=commitdiff;h=4b92112b820830b30cd7bc91bef3dd8f35305525
References: [2] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=692103
Other sources
The adddatabase function in objects.c in the pgbouncer pooler 1.5.2 for PostgreSQL allows remote attackers to cause a denial of service (daemon outage) via a long database name in a request.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-4575?
CVE-2012-4575 has been rated as a high severity vulnerability due to its potential to disrupt service.
How do I fix CVE-2012-4575?
To fix CVE-2012-4575, it is recommended to upgrade PgBouncer to the latest version available that contains the relevant security patches.
Which versions of PgBouncer are affected by CVE-2012-4575?
PgBouncer version 1.5.2 is specifically affected by CVE-2012-4575, allowing potential remote denial of service.
Can CVE-2012-4575 be exploited remotely?
Yes, CVE-2012-4575 can be exploited remotely by an attacker who sends specially crafted requests to the PgBouncer server.
What impact does CVE-2012-4575 have on PostgreSQL?
CVE-2012-4575 does not directly affect PostgreSQL but can lead to a denial of service in its connection pooling when using PgBouncer.