Threats tagged 'ghsa-qr4r-2rhh-hpj4'

A vulnerability in PostgreSQL involving external control of file names in the dblink and CREATE/ALTER SUBSCRIPTION features allows a user to cause persistent denial of service by appending invalid data to a chosen file. This occurs through the "sslkeylogfile" connection parameter, which appends data in NSS keylog format to a user-specified file but cannot add arbitrary bytes. The issue affects PostgreSQL major version 18 before minor version 18.7, and versions before 18 if libpq version 18 or later is used by the server.