CVE-2022-25852
Summary
| CVE | CVE-2022-25852 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2022-06-17 20:15:00 UTC |
| Updated | 2023-10-11 15:27:00 UTC |
| Description | All versions of package pg-native; all versions of package libpq are vulnerable to Denial of Service (DoS) when the addons attempt to cast the second argument to an array and fail. This happens for every non-array argument passed. **Note:** pg-native is a mere binding to npm's libpq library, which in turn has the addons and bindings to the actual C libpq library. This means that problems found in pg-native may transitively impact npm's libpq. |
Risk And Classification
Problem Types: CWE-704
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Libpq Project | Libpq | All | All | All | All |
| Application | Pg-native Project | Pg-native | All | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Denial of Service (DoS) in pg-native | CVE-2022-25852 | Snyk | CONFIRM | snyk.io | |
| Denial of Service (DoS) in libpq | CVE-2022-25852 | Snyk | CONFIRM | snyk.io | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
LEGACY: Cristian-Alexandru Staicu
LEGACY: Snyk Security Labs
There are currently no legacy QID mappings associated with this CVE.