CVE-2024-57651

What it actually does

The jp_add component in the affected database server accepts crafted SQL statements that trigger a denial of service condition, rendering the service unavailable.

Why it matters to the business

Successful exploitation can interrupt database-dependent services, causing operational downtime; low risk given absence from known exploited vulnerabilities lists and stable low exploit probability.

How an attack unfolds

An attacker locates an exposed instance, crafts malicious SQL targeting the jp_add component, and submits the statements to force the service into a non-responsive state.

How to fix it

Upgrade affected packages to the listed fixed versions: squid3 on Ubuntu 14.04 LTS to 3.3.8-1ubuntu6.8 and on Ubuntu 16.04 LTS to 3.5.12-1ubuntu7.2; apply equivalent patches or upgrades for the virtuoso-opensource component if separate fixes become available.

How to confirm the fix worked

Confirm package versions match the fixed releases, test that previously effective crafted SQL statements no longer cause service disruption, and monitor service stability under load.

Typical attack path

1. Locate publicly reachable database instance
2. Prepare crafted SQL statements for jp_add
3. Submit statements to trigger denial of service
4. Verify service unavailability

How to detect it

Review database query logs for unusual or malformed SQL statements targeting jp_add or similar components; correlate with sudden service restarts or availability alerts.

What your security team should do

• Prioritize patching the listed squid3 packages on Ubuntu 14.04 and 16.04 LTS systems
• Review network exposure of database services and restrict access where possible
• Monitor EPSS and KEV status for changes indicating rising threat activity