CVE-2009-0922

Published: 17 March 2009

PostgreSQL before 8.3.7, 8.2.13, 8.1.17, 8.0.21, and 7.4.25 allows remote authenticated users to cause a denial of service (stack consumption and crash) by triggering a failure in the conversion of a localized error message to a client-specified encoding, as demonstrated using mismatched encoding conversion requests.

Status

Notes

the denial of service is only temporary, so impact isn't great.
(should this be changed to "low priority"?)

upstream patch replaces core dump due to stack overflow with
core dump due to abort(), so doesn't fix temporary DoS
see http://archives.postgresql.org//pgsql-bugs/2009-02/msg00190.php

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0922
• https://ubuntu.com/security/notices/USN-753-1
• NVD
• Launchpad
• Debian

Bugs

• https://bugzilla.redhat.com/show_bug.cgi?id=488156
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=517405
• http://archives.postgresql.org/pgsql-bugs/2009-02/msg00172.php
• http://archives.postgresql.org//pgsql-bugs/2009-02/msg00176.php