CVE-2024-57647

What it actually does

The flaw in the row_insert_cast component allows crafted SQL statements to trigger a denial of service condition in the database engine.

Why it matters to the business

Potential loss of database availability leading to application downtime; low likelihood of exploitation based on current metrics and no known ransomware use.

How an attack unfolds

An attacker crafts malicious SQL statements targeting the row_insert_cast component and submits them to a vulnerable database instance, causing the server to crash or become unresponsive.

How to fix it

Upgrade all affected packages to the listed fixed versions: pidgin (Red Hat:enterprise_linux:3::as): fixed in 0:1.5.1-6.el3, pidgin-debuginfo (Red Hat:enterprise_linux:3::as): fixed in 0:1.5.1-6.el3, pidgin (Red Hat:enterprise_linux:3::desktop): fixed in 0:1.5.1-6.el3, pidgin-debuginfo (Red Hat:enterprise_linux:3::desktop): fixed in 0:1.5.1-6.el3, pidgin (Red Hat:enterprise_linux:3::es): fixed in 0:1.5.1-6.el3, pidgin-debuginfo (Red Hat:enterprise_linux:3::es): fixed in 0:1.5.1-6.el3, pidgin (Red Hat:enterprise_linux:3::ws): fixed in 0:1.5.1-6.el3, pidgin-debuginfo (Red Hat:enterprise_linux:3::ws): fixed in 0:1.5.1-6.el3.

How to confirm the fix worked

Confirm package versions match the fixed releases listed above and test database functionality with sample SQL statements to ensure stability.

Typical attack path

1. Locate an exposed database instance running the vulnerable version
2. Craft a malicious SQL statement
3. Submit the statement via a database client or application interface to trigger the DoS condition

How to detect it

Inspect database server logs and query audit trails for repeated or anomalous SQL statements that could indicate exploitation attempts.

What your security team should do

• Prioritize applying the listed package updates across all affected systems
• Review database access controls to limit exposure to untrusted SQL input
• Monitor EPSS score for any upward trend indicating increased exploit likelihood