CVE-2024-57660
Published: 14 January 2025
Description
An issue in the sqlo_expand_jts component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
Security Summary
CVE-2024-57660 affects the sqlo_expand_jts component in OpenLink Virtuoso Open-Source version 7.2.11. The vulnerability enables attackers to trigger a Denial of Service (DoS) condition through specially crafted SQL statements. It carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating high severity primarily due to its impact on availability, and is linked to CWE-89.
Remote attackers can exploit this vulnerability without authentication or user interaction, as it requires only network access and low attack complexity. Successful exploitation leads to a DoS, disrupting service availability on affected systems while causing no impact to confidentiality or integrity.
The primary reference for this issue is the GitHub advisory at https://github.com/openlink/virtuoso-opensource/issues/1221, which security practitioners should consult for details on patches or workarounds.
Details
- CWE(s)