GitHub Advisoryadvisory · npm

GHSA-j32j-2hxv-rqf7 pg-native and libpq vulnerable to uncontrolled resource consumption

HIGH Published 2022-06-18 Modified 2023-10-19 Official page ↗
Aliases
CVE-2022-25852
Ecosystem
npm
Packages
libpq, pg-native
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400, CWE-704
Reviewed
2022-06-20

Affected packages

• npm libpq: < 1.8.10 → fixed in 1.8.10 • npm pg-native: < 3.0.1 → fixed in 3.0.1

Description

pg-native before 3.0.1 and libpq before 1.8.10 are vulnerable to Denial of Service (DoS) when the addons attempt to cast the second argument to an array and fail. This happens for every non-array argument passed. Note: pg-native is a mere binding to npm's libpq library, which in turn has the addons and bindings to the actual C libpq library. This means that problems found in pg-native may transitively impact npm's libpq.

Related

Alias · CVE (1)

  • CVE-2022-25852 All versions of package pg-native; all versions of package libpq are vulnerable to Denial of Service (DoS) when the addons attempt to cast… vulnerability

Weakness · CWE (2)

  • CWE-400 Uncontrolled Resource Consumption weakness
  • CWE-704 Incorrect Type Conversion or Cast weakness

References