## Summary
PostgreSQL contains a heap buffer overflow in to_char(timestamptz) that can be triggered by supplying a long POSIX timezone abbreviation. A remote party that can influence the timezone can achieve arbitrary code execution as the operating system user running the database.
## Technical Details
- Vulnerability type: heap buffer overflow (CWE-122) in PostgreSQL to_char(timestamptz).
- Trigger condition: a long POSIX timezone abbreviation provided by the party choosing the timezone.
- Result: arbitrary code execution in the PostgreSQL process context, leading to full compromise of confidentiality, integrity, and availability.
- Attack surface: network-accessible SQL usage where the attacker can control the timezone input.
- CVSS indicates: AV:N (network), PR:L (low privileges), UI:N (no user interaction), with high impact (C:H/I:H/A:H).
## Affected
- PostgreSQL versions before:
- 18.5
- 17.11
- 16.15
- 15.19
- 14.24
## Impact
- Remote code execution as the operating system user running the PostgreSQL server.
- Potential outcomes include:
- Confidentiality loss (C:H)
- Integrity loss (I:H)
- Availability loss (A:H)
## Mitigation
1. Upgrade PostgreSQL to a fixed release: 18.5, 17.11, 16.15, 15.19, or 14.24.
2. Reduce the ability for untrusted users to influence the timezone argument used with to_char(timestamptz) (e.g., restrict SQL inputs/roles that can set timezone-related parameters).
3. Monitor for abnormal query patterns involving to_char(timestamptz) with unusually long timezone abbreviations.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-122