GHSA-3gjw-f78c-vvpw: Rust/tokio-postgres vulnerability
A malicious or compromised server can send a row containing fewer fields than its row description declares columns. Reading one of the missing columns then panics with an out-of-bounds index, aborting the calling task. This affects even the otherwise non-panicking tryget, and both Row and SimpleQueryRow.
Applications that connect only to a trusted database are not exposed; the risk applies to clients that may connect to untrusted or user-supplied servers, or whose connection can be intercepted by a man-in-the-middle.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rust/tokio-postgresto a version that resolves this vulnerability.Fixed in 0.7.18
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Clients that may connect to untrusted or user-supplied PostgreSQL servers are exposed. Clients can also be affected when a connection to the database can be intercepted or modified by a man-in-the-middle; applications connecting only to a trusted database are not exposed.
What does an attacker need to do to trigger the failure?
The attacker needs to control a server, or modify the server response in transit, so that it returns a row with fewer fields than declared in its row description. The application must then read one of the missing columns.
Does using try_get prevent the panic?
No. The issue affects the otherwise non-panicking try_get method as well as Row and SimpleQueryRow.
What can be done if updating is not immediately possible?
Limit connections to trusted database servers and prevent man-in-the-middle interception or modification of database connections. This removes the untrusted response source required to trigger the issue.