CVE-2024-57635

What it actually does

Improper input validation in the chash_array component allows crafted SQL statements to trigger a denial of service condition by crashing or exhausting resources in the affected database component.

Why it matters to the business

Organizations using the affected software may experience unplanned downtime and loss of availability for database services; the issue affects multiple Red Hat packages with a low EPSS score and no known exploitation or ransomware use after 635 days since publication.

How an attack unfolds

An attacker with the ability to execute SQL statements against the vulnerable database can craft specific queries targeting the chash_array component, leading to a crash or resource exhaustion without requiring authentication beyond normal database access.

How to fix it

Upgrade affected packages to the specified fixed versions including java-1.6.0-ibm (Red Hat:rhel_extras:4) to 1:1.6.0.5-1jpp.1.el4, java-1.6.0-ibm (Red Hat:rhel_extras:5::client) to 1:1.6.0.5-1jpp.1.el5, and equivalent updates for all listed demo, devel, jdbc, plugin, and src packages on RHEL 4 and 5.

How to confirm the fix worked

Confirm installed package versions match or exceed the listed fixed versions using package managers, then test that crafted SQL no longer causes crashes in the chash_array component.

Typical attack path

1. Identify a target running the vulnerable software version
2. Craft malicious SQL statements exploiting the chash_array input handling flaw
3. Submit the statements through available database interfaces or applications
4. Trigger repeated execution to cause service denial

How to detect it

Review database server logs for crashes or errors following unusual SQL statements, monitor for resource exhaustion patterns linked to chash_array processing, and check application query logs for malformed inputs.

What your security team should do

• Apply the listed package updates as soon as possible given the age since publication
• Restrict untrusted SQL execution privileges where feasible
• Monitor database logs for repeated query failures or crashes