Executive brief
Asyncpg is a PostgreSQL database driver library for Python applications. A malicious or compromised PostgreSQL server can send specially crafted array data that causes the client library to access uninitialized memory, leading to crashes or arbitrary code execution on the client machine.
Technical details
Asyncpg versions prior to 0.21.0 contain an uninitialized pointer access vulnerability (CWE-824) in the array data decoder component. When the library processes multi-dimensional array responses from a PostgreSQL server, it fails to validate array dimensions, leading to out-of-bounds access to uninitialized memory. An attacker controlling a malicious PostgreSQL server (or intercepting the connection) can craft a specially formatted server response to trigger this flaw. This can result in information disclosure, memory corruption, or arbitrary code execution on the client system. The vulnerability requires network access to the database connection but no authentication or user interaction; it is fixed in version 0.21.0.
Affected products
- MagicStack asyncpg before 0.21.0
Timeline
- 2020-08-12: disclosed: CVE-2020-17446 published
- 2020: patched: Fixed in asyncpg 0.21.0
- 2021-04-20: advisory: GHSA-2xpj-f5g2-8p7m published