UBUNTU-CVE-2020-17446: Critical severity ubuntu/asyncpg vulnerability
asyncpg before 0.21.0 allows a malicious PostgreSQL server to trigger a crash or execute arbitrary code (on a database client) via a crafted server response, because of access to an uninitialized pointer in the array data decoder.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/asyncpgto a version that resolves this vulnerability.Fixed in 0.13.0-1ubuntu3+esm1 - Upgrade
Upgrade
ubuntu/asyncpgto a version that resolves this vulnerability.Fixed in 0.20.0-1ubuntu0.1~esm1
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Database clients using asyncpg versions before 0.21.0 are exposed when they connect to a malicious PostgreSQL server. The impact occurs on the client, not only on the server.
What does an attacker need to exploit it?
An attacker needs to control, or cause the client to connect to, a PostgreSQL server that can send a crafted response. No client-side privileges or user interaction are required according to the supplied vector.
What is the potential impact?
A crafted PostgreSQL server response can crash the database client or result in arbitrary code execution on that client.