CVE-2020-10531 - Integer overflow in ICU doAppend()

First Published: 2024/11/14

Last Updated: 2024/11/14

Important

This is an assessment of the impact of CVE-2020-10531 on EDB products and services. It links to and details the CVE and supplements that information with EDB's own assessment.

Summary

The original vulnerability was an integer overflow leading to a heap-based buffer overflow in UnicodeString::doAppend() in ICU (International Components for Unicode) for C/C++ which existed up to (and including) version 66.1.

In the process of validating EDB Postgres Advanced Server 17, a release check identified the presence of a pre 67.1 version of the library being used.

It had been believed that existing versions of EPAS had been built with a later library version.

While most EDB software builds against the operating system provided version of ICU, EDB Postgres Advanced Server can include EDB’s own build of ICU 66.1, specifically on RHEL7 on x86_64/PPCLE, RHEL8 on x86_64/PPCLE, SLES 12 x86_64/PPCLE/s390x, and SLES 15 x86_64/PPCLE/s390x. On RHEL9, the OS supplied library (version 67.1) is used.

EDB Postgres Extended and Postgres use the OS supplied ICU libraries, and are not affected by this vulnerability.

It has been established that EDB’s code does not use the vulnerable function.
Assessment and mitigation: In the interests of ensuring that the vulnerable library doesn’t provide any surface for an attacker, we are releasing updated versions of all affected products.

Vulnerability Details

CVE-ID: CVE-2020-10531

CVSS Base Score: 8.8

CVSS Temporal Score: Undefined

CVSS Environmental Score: Undefined

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected Products and Versions

EnterpriseDB Postgres Advanced Server

On RHEL 7/8 (x86_64/PPCLE) and SLES 12/15 (x86_64/PPCLE/s390x)

• All versions of EPAS prior to 16.5.0
• All versions of EPAS prior to 15.9.0
• All versions of EPAS prior to 14.14.0
• All versions of EPAS prior to 13.17.0

Remediation

EDB Postgres Advanced Server Version Information

If you are unable to upgrade your EPAS installation, upgrade the installed edb-icu

Reference

• CVSS #3.1 Calculator

Related Information

• EnterpriseDB
• Postgresql
• EDB Postgres Advanced Server

Change History

14 November 2024: Original Copy Published

Disclaimer

This document is provided on an "as is" basis and does not imply any kind of guarantee or warranty, including the warranties of merchantability or fitness for a particular use. Your use of the information on the document is at your own risk. EDB reserves the right to change or update this document at any time. Customers are therefore recommended to always view the latest version of this document.