CyberRota Analysis
AI-GeneratedThe address_standardizer extension in PostGIS versions up to 3.7.0 is vulnerable to an out-of-bounds write due to improper bounds checking when processing user-supplied relation names in the standardize_address() function. This flaw can lead to memory corruption, potentially allowing attackers to execute arbitrary code or disrupt database operations. Database administrators and security teams using affected versions should prioritize patching this vulnerability to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
The address_standardizer extension for PostGIS through 3.7.0, fixed in commit 423570b, contains an out-of-bounds write vulnerability that allows a database user with the ability to supply caller-controlled relation names to standardize_address() to trigger memory corruption by providing a rules table with a classification Type value exceeding the fixed class range. Attackers can craft a malicious rules table entry with an oversized rule type value that is used without bounds checking as an index into an internal output-link table, resulting in an out-of-bounds write.