CVE-2020-21469: postgresql Classic Buffer Overflow

Vulnerability summary

CVE-2020-21469 is a medium (CVSS 4.4) Classic Buffer Overflow vulnerability in postgresql. EPSS estimates a 0.37% chance of exploitation in the next 30 days, higher than 29.1% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 22-08-2023
   PublishedVulnerability first disclosed.
2. 04-08-2024
   Last modifiedVulnerability information updated.

Description

An issue was discovered in PostgreSQL 12.2 allows attackers to cause a denial of service via repeatedly sending SIGHUP signals. NOTE: this is disputed by the vendor because untrusted users cannot send SIGHUP signals; they can only be sent by a PostgreSQL superuser, a user with pg_reload_conf access, or a user with sufficient privileges at the OS level (the postgres account or the root account).

• CWE-120Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.