asyncpg before 0.21.0 allows a malicious PostgreSQL server to trigger a crash or execute arbitrary code (on a database client) via a crafted server response, because of access to an uninitialized pointer in the array data decoder.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - asyncpg before 0.21.0 allows a malicious PostgreSQL server to trigger a crash or execute arbitrary code     (on a database client) via a crafted server response, because of access to an uninitialized pointer in the     array data decoder. (CVE-2020-17446)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - asyncpg before 0.21.0 allows a malicious PostgreSQL server to trigger a crash or execute arbitrary code
    (on a database client) via a crafted server response, because of access to an uninitialized pointer in the
    array data decoder. (CVE-2020-17446)

asyncpg before 0.21.0 allows a malicious PostgreSQL server to trigger a crash or execute arbitrary code (on a database client) via a crafted server response, because of access to an uninitialized pointer in the array data decoder.

For Debian 9 stretch, this problem has been fixed in version 0.8.4-1+deb9u1.

We recommend that you upgrade your asyncpg packages.

For the detailed security status of asyncpg please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/asyncpg

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
255719	Linux Distros Unpatched Vulnerability : CVE-2020-17446	Nessus	Misc.	critical
409178	SCA: security update for asyncpg (GHSA-2xpj-f5g2-8p7m)	Tenable Cloud Security	SCA Checks	critical
409178	SCA: security update for asyncpg (GHSA-2xpj-f5g2-8p7m)	Tenable Self-Hosted Container Security	SCA Checks	critical
140225	Debian DLA-2363-1 : asyncpg security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2020-17446

critical

Tenable Plugins

critical

critical

critical

critical