CVE-2022-25852 Denial of Service (DoS)
Attackers can cause a denial of service in pg-native and libpq by passing non-array arguments that trigger casting failures.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-25852?
CVE-2022-25852 is a high-severity denial of service vulnerability in libpq, published on 17 Jun 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
All versions of package pg-native; all versions of package libpq are vulnerable to Denial of Service (DoS) when the addons attempt to cast the second argument to an array and fail. This happens for every non-array argument passed. **Note:** pg-native is a mere binding to npm's libpq library, which in turn has the addons and bindings to the actual C libpq library. This means that problems found in pg-native may transitively impact npm's libpq.
Weakness: CWE-704
Which versions are affected by CVE-2022-25852?
4 open source packages ship an affected version, including libpq and pg-native. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
libpq npm | All versions | 1.8.10 |
libpq npm | All versions | 1.8.10 |
pg-native npm | All versions | 3.0.1 |
pg-native npm | All versions | 3.0.1 |
Products include Libpq Project Libpq, Pg-Native Project Pg-Native.
How do I fix CVE-2022-25852?
Upgrade libpq to 1.8.10 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2022-25852 being exploited?
There is no known exploitation of CVE-2022-25852 in the wild and no public exploit code.
Sources
Also known as GHSA-j32j-2hxv-rqf7.