Critical Path traversal when declaring external routine, also existing on Firebird 2.x?

Hi Community,

does the critical CVE also affect the v2.x? Since the PluginManager came after version 3.x.

As far as I know nobody used to check it in unsupported version. There is minimal reproduction in GHSA-7pxc-h3rv-r257, you may try yourself.

PS. Using FB2 without good firewall protection is anyway bad idea. And if you have well-tuned protection bug becomes not so critical?

IIRC, there are no external routines in v2.x.

Although Firebird 2.x doesn't have external routines, UDF have a similar flaw.

That said, Firebird 2.5 has been end-of-life since June 2019: if you care about security, it is high time you upgrade.

In any case, I'll convert this to a discussion, as it is a question and not a bug report.

Navigation Menu