OpenLink Virtuoso Denial-of-Service Vulnerability in jp_add Component

A denial-of-service vulnerability has been identified in OpenLink Virtuoso Open Source version 7.2.11. The issue arises in the jp_add component, where attackers can cause a service disruption by sending crafted SQL statements. This vulnerability can be reproduced using the beta Docker image of Virtuoso 7.2.11.

Impact

Exploitation of this vulnerability leads to a crash of the Virtuoso database server, causing a denial-of-service condition.

Reproduction

The vulnerability can be reproduced by first removing any existing Docker container named 'virtdb_test'. Then, a new Docker container can be started with the Virtuoso 7.2.11 image, using 'dba' as the password. After the server has started, a simple SQL query can be executed to verify that the database is responsive. Once confirmed, the crafted SQL payload that exploits the vulnerability can be executed, causing the server to crash.