tokio-postgres Rust Crate Vulnerability: Early Warning
- Severity
- HIGH
- Affected component
- tokio-postgres (cargo)
- Affected versions
- >= 0.4.0, < 0.7.18 or >= 0.4.0, < 0.7.18
- Patched version
- Not yet available
An early warning has been issued regarding a vulnerability in the tokio-postgres Rust crate. This issue can cause the crate to panic and abort tasks when a malicious or compromised server sends a row with fewer fields than declared.
What happened
The vulnerability affects both `Row` and `SimpleQueryRow` in the tokio-postgres crate. It is reportedly triggered when a server sends a `DataRow` with fewer fields than the number of columns declared. This can lead to a denial of service by causing the crate to panic and abort tasks.
The affected versions of tokio-postgres are those greater than or equal to 0.4.0 and less than 0.7.18. The issue is under investigation and no exploit in the wild has been confirmed at this time.
What to do about it
- Avoid connecting to untrusted servers to mitigate the risk of this vulnerability.
- Ensure that connections to servers are secure to prevent man-in-the-middle attacks.
- Monitor the primary sources for updates on this vulnerability.
- Consult the primary sources for the latest information on any available patches or fixes.
How 0Day would have caught this
tokio-postgres is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using tokio-postgres versions greater than or equal to 0.4.0 and less than 0.7.18.
What should I do right now?
Avoid connecting to untrusted servers and ensure that your connections are secure. Monitor the primary sources for updates on this vulnerability.
Is there a patch available?
No official fix has been published yet. Monitor the sources for updates.