GHSA-cv9q-3h4j-rv5m: Out-of-Bounds Read in Babelfish for PostgreSQL TDS RPC Procedure-Name Parser
An out-of-bounds read in the TDS RPC procedure-name parser in the Babelfish for PostgreSQL extension versions 1.0-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 and in Amazon Aurora PostgreSQL with Babelfish might allow remote authenticated users to read adjacent process memory or cause a denial of service via a malformed TDS RPC request to the TDS port (default 1433).
To remediate this issue, we recommend users upgrade to Babelfish for PostgreSQL extension versions 4.10, 5.6, 6.1 or later. As a workaround, restrict network access to the TDS port (default 1433). Customers using Amazon Aurora PostgreSQL with Babelfish should upgrade their cluster to Aurora PostgreSQL 13.9.16 (1.5.5), 13.23.3 (1.17.2), 14.6.16 (2.3.5), 14.17.8 (2.12.4), 14.18.6 (2.13.3), 14.19.5 (2.14.2), 14.20.5 (2.15.2), 14.22.3 (2.16.1), 14.23.1 (2.17.0), 15.10.8 (3.8.4), 15.12.8 (3.9.4), 15.13.6 (3.10.3), 15.14.5 (3.11.2), 15.15.5 (3.12.2), 15.17.3 (3.13.1), 15.18.1 (3.14.0), 16.8.8 (4.5.5), 16.9.6 (4.6.3), 16.10.5 (4.7.2), 16.11.5 (4.8.2), 16.13.3 (4.9.1), 16.14.1 (4.10.0), 17.4.8 (5.1.4), 17.5.6 (5.2.3), 17.6.5 (5.3.2), 17.7.5 (5.4.2), 17.9.3 (5.5.1), 17.10.1 (5.6.0), 18.3.4 (6.0.2), 18.4.1 (6.1.0) or later, and apply any pending maintenance to ensure they are on the latest patch.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Babelfish for PostgreSQL extensionto a version that resolves this vulnerability.Fixed in 6.1 - Upgrade
Upgrade
Amazon Aurora PostgreSQL with Babelfishto a version that resolves this vulnerability.Fixed in 18.4.1 (6.1.0) - Compensating control
Restrict network access to the TDS port (default 1433).
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be an authenticated user able to send a malformed TDS RPC request to the Babelfish TDS service. Systems are exposed where that service is reachable on the TDS port, which defaults to 1433.
What can an attacker do with successful exploitation?
The issue may allow an authenticated remote user to read adjacent process memory or cause a denial of service.
What is the mitigation if an upgrade cannot be applied immediately?
Restrict network access to the TDS port, which defaults to 1433. This reduces access to the affected RPC parser while an upgrade is planned.
Which Babelfish extension releases remediate the issue?
Upgrade to Babelfish for PostgreSQL extension version 4.10, 5.6, 6.1, or later.
Which Amazon Aurora PostgreSQL with Babelfish releases include remediation?
Upgrade the cluster to one of the listed fixed Aurora releases or later, including 13.9.16 (1.5.5), 14.22.3 (2.16.1), 15.17.3 (3.13.1), 16.14.1 (4.10.0), 17.10.1 (5.6.0), or 18.4.1 (6.1.0).