CVE-2024-57660

What it actually does

Crafted SQL statements trigger a denial of service condition in the sqlo_expand_jts component by causing the database server to crash or become unresponsive.

Why it matters to the business

Service disruption for database-dependent applications, potential downtime, and resource exhaustion without data loss or unauthorized access.

How an attack unfolds

An attacker sends specially crafted SQL queries to the Virtuoso server, exploiting the vulnerability in sqlo_expand_jts to induce DoS.

How to fix it

Upgrade affected packages to the listed fixed versions: hdf5 on Ubuntu 14.04 LTS to 1.8.11-5ubuntu7.1 and on Ubuntu 16.04 LTS to 1.8.16+docs-4ubuntu1.1; apply vendor patches for virtuoso-opensource if separate updates are released.

How to confirm the fix worked

Confirm package versions match fixed releases, test crafted SQL statements no longer cause crashes, and monitor server stability under load.

Typical attack path

1. Identify exposed database instance accepting SQL input
2. Craft malicious SQL statement targeting sqlo_expand_jts logic
3. Submit query via client connection to trigger crash or hang
4. Repeat submissions to sustain denial of service

How to detect it

Review database query logs and error logs for repeated malformed statements leading to crashes or high resource usage around the sqlo_expand_jts component.

What your security team should do

• Apply the specified package upgrades immediately on all affected Ubuntu systems
• Restrict direct SQL access from untrusted sources until patched
• Monitor EPSS score and any emerging exploit code for increased urgency