GHSA-5x78-73v4-xg6w: Rust/postgres-protocol vulnerability
A malicious, compromised, or man-in-the-middle server can supply an arbitrarily large SCRAM-SHA-256 PBKDF2 iteration count during authentication. The client runs it inline with no upper bound, pinning a tokio worker thread for minutes per connection, possibly stalling the whole async runtime.
Applications that connect only to a trusted database are not exposed; the risk applies to clients that may connect to untrusted or user-supplied servers, or whose connection can be intercepted by a man-in-the-middle.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rust/postgres-protocolto a version that resolves this vulnerability.Fixed in 0.6.12
Event History
Frequently Asked Questions
Which deployments are realistically exposed?
Clients are exposed when they may connect to untrusted or user-supplied database servers, or when an attacker can intercept the connection as a man in the middle. Applications that connect only to a trusted database are not exposed.
What must an attacker do to trigger the denial of service?
The attacker must control, compromise, or intercept the server used during authentication and supply an arbitrarily large SCRAM-SHA-256 PBKDF2 iteration count. The client processes that value inline without an upper bound, tying up a Tokio worker thread for minutes per connection.
What is the operational effect of exploitation?
Each malicious authentication can pin a Tokio worker thread for minutes. Multiple affected connections may stall the application's async runtime.