Security vulnerabilities and automated fixes for database security issues
2 posts found
A database query in DBeaver's Altibase extension was constructing SQL statements using `String.format()` with user-controlled input, creating a classic SQL injection vulnerability. The fix replaces the unsafe string interpolation with parameterized queries using `PreparedStatement`, ensuring user input is always treated as data rather than executable SQL. This type of vulnerability is deceptively simple to introduce but equally simple to fix once you know what to look for.
A critical buffer overflow vulnerability was discovered and patched in Odyssey's SCRAM-SHA-256 authentication implementation, where six unchecked `memcpy` calls allowed unauthenticated attackers to corrupt heap memory by sending crafted oversized fields during authentication. This type of vulnerability is especially dangerous because it requires no credentials to exploit — any client initiating a connection could trigger it. The fix enforces proper length validation before every memory copy oper