Description
PostGIS address_standardizer through 3.7.0 fails to validate the Weight parameter from caller-supplied rules tables before using it as an array index. Attackers can craft malicious rule rows with out-of-range Weight values to trigger out-of-bounds reads in the load_value array, causing the PostgreSQL backend process to crash and terminate all cluster sessions.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
PostGIS address_standardizer
Default version status: unaffected
0 to ≤ 3.7.0affected
pkg:github/postgis/address_standardizerReferences
- https://github.com/postgis/address_standardizer/blob/v3.7.0/src/gamma.c#L301-L311 ↗
- https://github.com/postgis/address_standardizer/blob/v3.7.0/src/analyze.c#L860 ↗
- https://github.com/postgis/address_standardizer/blob/e987949e0fccff6a0e7a6d3f86814d5c7a01f481/NEWS.md ↗
- https://github.com/postgis/address_standardizer/pull/6 ↗
- https://github.com/postgis/address_standardizer/commit/a5cb4b1360a040973092f13b1af97a718e7e104a ↗
- https://github.com/postgis/address_standardizer/commit/e987949e0fccff6a0e7a6d3f86814d5c7a01f481 ↗
- https://github.com/postgis/address_standardizer ↗
- https://www.vulncheck.com/advisories/postgis-address-standardizer-through-3.7.0-out-of-bounds-read-via-unvalidated-rule-weight ↗