Description
The add_database function in objects.c in the pgbouncer pooler 1.5.2 for PostgreSQL allows remote attackers to cause a denial of service (daemon outage) via a long database name in a request.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | pgbouncer | 1.5.2-4 | — |
| Debian 13 | pgbouncer | 1.5.2-4 | — |
| Debian 12 | pgbouncer | 1.5.2-4 | — |
References
- 56371 vdb-entry
- http://git.postgresql.org/gitweb/?p=pgbouncer.git%3Ba=commit%3Bh=4b92112b820830b30cd7bc91bef3dd8f35305525
- https://bugzilla.redhat.com/show_bug.cgi?id=872527
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=692103
- [oss-security] 20121102 Re: CVE Request -- pgbouncer: DoS (pooler server shutdown) by adding database with large name mailing-list