CVE-2024-57652

What it actually does

Crafted SQL statements trigger a crash or resource exhaustion in the numeric_to_dv component, causing the server process to become unavailable.

Why it matters to the business

Service downtime for database-dependent applications, potential loss of access to data until the affected instance is restarted or patched.

How an attack unfolds

An attacker with the ability to submit SQL statements sends specially formatted queries that exploit the numeric_to_dv handling flaw, resulting in denial of service without requiring authentication or further privileges.

How to fix it

Upgrade to the fixed versions listed for each affected Ubuntu release of wireshark; apply vendor patches for virtuoso-opensource if separate updates become available.

How to confirm the fix worked

Verify package versions match the provided fixed releases, test that crafted SQL no longer causes process termination, and monitor service availability under load.

Typical attack path

1. Obtain network or local access to submit SQL statements to the target instance
2. Craft and transmit malicious SQL statements targeting the numeric_to_dv component
3. Trigger repeated crashes or resource exhaustion to sustain the denial of service

How to detect it

Review database server logs for repeated crashes or error entries tied to numeric_to_dv processing; inspect SQL audit trails for anomalous numeric literals or malformed statements around the time of outages.

What your security team should do

• Apply the listed fixed package versions immediately on all affected Ubuntu systems
• Restrict direct SQL submission privileges to trusted users only
• Monitor for unusual SQL patterns that could indicate probing attempts