REDHAT-BUG-2477445: High severity PostgreSQL postgresql vulnerability
Uncontrolled recursion in PostgreSQL SSL and GSS negotiation allows an attacker able to connect to a PostgreSQL AFUNIX socket to achieve sustained denial of service. If SSL and GSS are both disabled, an attacker can do the same via access to a PostgreSQL TCP socket. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.4 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 17.10 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.14 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.18 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 14.23 - Compensating control
Mitigate the described sustained denial of service by restricting access to PostgreSQL AF_UNIX sockets so untrusted attackers cannot connect (e.g., limit local access via filesystem permissions and/or host-level network/isolation controls).
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2477445?
The severity of REDHAT-BUG-2477445 is rated as high with a score of 7.
How do I fix REDHAT-BUG-2477445?
To fix REDHAT-BUG-2477445, upgrade to PostgreSQL version 18.4 or later.
What type of vulnerability is REDHAT-BUG-2477445?
REDHAT-BUG-2477445 is characterized as an uncontrolled recursion vulnerability leading to a denial of service.
Which versions of PostgreSQL are affected by REDHAT-BUG-2477445?
Versions of PostgreSQL prior to 18.4 are affected by REDHAT-BUG-2477445.
What are the attack vectors for REDHAT-BUG-2477445?
Attackers can exploit REDHAT-BUG-2477445 by accessing PostgreSQL AF_UNIX sockets or, if SSL and GSS are disabled, via TCP sockets.