CVE-2024-57645

What it actually does

A flaw in the qi_inst_state_free component allows crafted SQL statements to trigger a denial of service condition, likely through resource exhaustion or crash.

Why it matters to the business

Attackers can disrupt database services, leading to downtime and potential loss of availability for applications relying on the system.

How an attack unfolds

An attacker sends specially crafted SQL statements to the server, exploiting the qi_inst_state_free function to cause a crash or hang.

How to fix it

Upgrade affected packages to the listed fixed versions such as java-1.4.2-ibm (Red Hat:rhel_extras:3) fixed in 0:1.4.2.13.1-1jpp.1.el3 and equivalent updates for all other listed variants across RHEL 3, 4 and 5 client/server channels.

How to confirm the fix worked

Confirm package versions match the fixed releases, retest connectivity with similar SQL patterns, and monitor for absence of crashes in the qi_inst_state_free component.

Typical attack path

1. Identify exposed database instance accepting SQL
2. Craft malicious SQL query targeting the vulnerable component
3. Submit query via client connection or application interface
4. Observe service crash or unavailability

How to detect it

Review database query logs and system crash reports for entries referencing qi_inst_state_free or unusual SQL patterns that precede service restarts.

What your security team should do

• Apply the listed package updates across all affected Red Hat channels without delay
• Restrict direct SQL access from untrusted sources
• Enable query logging and resource limits on database instances