Bugzilla – Bug 1201215
VUL-0: CVE-2017-18359: librttopo: denial of service in rtgeom_to_x3d3()
Last modified: 2022-07-06 13:17:25 UTC
rh#1669659 PostGIS 2.x before 2.3.3, as used with PostgreSQL, allows remote attackers to cause a denial of service via crafted ST_AsX3D function input, as demonstrated by an abnormal server termination for "SELECT ST_AsX3D('LINESTRING EMPTY');" because empty geometries are mishandled. References: https://trac.osgeo.org/postgis/changeset/15444 https://trac.osgeo.org/postgis/changeset/15445 https://trac.osgeo.org/postgis/ticket/3704 References: https://bugzilla.redhat.com/show_bug.cgi?id=1669659 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-18359 http://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-18359.html http://www.cvedetails.com/cve/CVE-2017-18359/ http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18359 https://trac.osgeo.org/postgis/changeset/15444 https://trac.osgeo.org/postgis/changeset/15445 https://trac.osgeo.org/postgis/ticket/3704 https://lists.debian.org/debian-lts-announce/2019/01/msg00030.html https://lists.debian.org/debian-lts-announce/2021/12/msg00020.html
This CVE was assigned to an issue in PostGIS, but librttopo shares the same code. I asked MITRE for a new CVE but they ignored the request. Fix: https://gitlab.com/rttopo/rttopo/-/commit/2a9cc526b1da8ea58422ed0158f57dabd82c498d
Hello Carlos, Don't we have postgis 3.2.1 ? 2.3.3 is such an oldies I hope nobody is still using it.
(In reply to Bruno Friedmann from comment #2) > Don't we have postgis 3.2.1 ? > > 2.3.3 is such an oldies I hope nobody is still using it. The code in librttopo has the same bug, even in the newer versions: ``` $ osc co openSUSE:Factory librttopo $ cd openSUSE:Factory/librttopo $ quilt setup librttopo.spec $ grep -FA8 "rtgeom_to_x3d3(" librttopo/src/rtout_x3d.c rtgeom_to_x3d3(const RTCTX *ctx, const RTGEOM *geom, char *srs, int precision, int opts, const char *defid) { int type = geom->type; switch (type) { case RTPOINTTYPE: return asx3d3_point(ctx, (RTPOINT*)geom, srs, precision, opts, defid); ``` The code above is missing the check added in the patch in comment #1.
Sorry for the confusion, you shouldn't have talk about postgis :-) Ok the proposed patch is not enough alone it also need additionnal fixes present in https://git.osgeo.org/gitea/rttopo/librttopo/pulls/41/files Fixes will goes first to Application:Geo then Factory. Once in they will be proposed to Backport.
SR to Factory done SR to Maintenance done https://build.opensuse.org/request/show/986877
openSUSE-SU-2022:10042-1: An update that fixes one vulnerability is now available. Category: security (important) Bug References: 1201215 CVE References: CVE-2017-18359 JIRA References: Sources used: openSUSE Backports SLE-15-SP4 (src): librttopo-1.1.0-bp154.2.3.1