Skip to content

Commit 1ea1399

Browse files
committed
new vulnerability in postgres-types
1 parent 4cc7bba commit 1ea1399

File tree

1 file changed

+6
-7
lines changed

1 file changed

+6
-7
lines changed

input/new.json

Lines changed: 6 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,26 +1,25 @@
11
{
22
"package_name": "postgres-types",
33
"patch_versions": [
4-
"3.99.2"
4+
"0.2.9"
55
],
66
"vulnerable_ranges": [
77
[
8-
"3.34.0",
9-
"3.99.1"
8+
"0.1.0",
9+
"0.2.8"
1010
]
1111
],
1212
"cwe": [
13-
"CWE-476",
13+
"CWE-248",
1414
"CWE-400"
1515
],
16-
"tldr": "Affected versions of this package are vulnerable to a explicit null-dereference in the `internal/credentials/static.go::parseExpiresAt` function. This flaw can lead to crashes, potentially causing a Denial of Service (DoS). Proper handling of null values is necessary to prevent such issues, as it could result in system instability or unresponsiveness when exploited.",
16+
"tldr": "Affected versions of this package are vulnerable to uncaught exceptions. A panic occurs when attempting to retrieve a `PrimitiveDateTime` value in the `from_sql` function, if it is set to infinity. This issue can cause unexpected crashes, potential denial-of-service (DoS) conditions, or instability in applications relying on this functionality.",
1717
"doest_this_affect_me": "You are affected if you are using a version that falls within the vulnerable range.",
1818
"how_to_fix": "Upgrade the `postgres-types` library to the patch version.",
1919
"reporter": "",
20-
"vulnerable_to": "NULL Pointer Dereference",
20+
"vulnerable_to": "Uncaught Exception",
2121
"related_cve_id": "",
2222
"language": "RUST",
2323
"severity_class": "LOW",
24-
"aikido_score": 16,
2524
"changelog": "https://github.com/sfackler/rust-postgres/blob/master/postgres-types/CHANGELOG.md"
2625
}

0 commit comments

Comments
 (0)