UpTrajectory Review
Recent findings reveal that AI is playing a crucial role in identifying long-standing vulnerabilities in popular open-source databases, specifically PostgreSQL and MariaDB. Security researchers have uncovered several critical issues, including a zero-day bug in PostgreSQL's pgcrypto extension and a heap buffer overflow in MariaDB's JSON schema validation. These vulnerabilities, some dating back over two decades, pose significant risks as they allow for remote code execution, making immediate action necessary for database administrators.
For small business operators relying on these databases, the urgency to apply patches cannot be overstated. The vulnerabilities affect all supported versions, meaning that any delay in upgrading could expose sensitive data and systems to potential attacks. This situation highlights the importance of staying informed about security updates and the evolving landscape of cybersecurity threats. While the use of AI in vulnerability detection is promising, it also underscores the need for proactive measures in database management.
“The vulnerable code has been present since pgcrypto was first contributed in 2005, more than 20 years ago.” — InfoWorld
Takeaway: Ensure your PostgreSQL and MariaDB installations are updated immediately to mitigate critical vulnerabilities.
Excerpt from the original — InfoWorld
Open-source databases are facing a bit of a memory problem as AI helps surface decades-old buffer overflow issues in widely used components. Security researchers have disclosed a set of high and critical-severity vulnerabilities affecting PostgreSQL and MariaDB, with two bugs reportedly tracing their roots back more than 20 years.
At Wiz’s zeroday.cloud hacking event, researchers using the AI-powered security analysis tool “Xint Code” found a high-severity zero-day bug in PostgreSQL’s “pgcrypto” extension, and a heap buffer overflow in MariaDB’s JSON schema validation logic, both allowing remote code execution (RCE) on respective database servers.
The Xint Code team also uncovered a missing validation bug in PostgreSQL, hidden for 20 years, allowing attackers to write arbitrary code.
Patches have been released for all these flaws, with both PostgreSQL and MariaDB maintainers …