Overview
About vulnerability
The DataRow.Decode function fails to properly validate field lengths. A malicious or compromised PostgreSQL server can send a DataRow message with a negative field length, causing a slice bounds out of range panic.Details
- Affected product:
- GoogleCloudPlatform/cloud-sql-proxy/cloudsql-proxy , Grafana , github.com/GoogleCloudPlatform/cloudsql-proxy , github.com/jackc/pgconn , github.com/jackc/pgmock , github.com/jackc/pgproto3 , github.com/jackc/pgtype , github.com/jackc/pgx , gobuffalo/pop , gocloud.dev , google/go-cloud , jackc/pgconn , jackc/pgmock , jackc/pgproto3 , jackc/pgtype , jackc/pgx , ory/x
- Affected packages:
- github.com/jackc/pgproto3 @ 2.2.0 (+17 more)