OpenLink Virtuoso Denial-of-Service Vulnerability in sqlg_group_node Component

A denial-of-service vulnerability has been identified in the sqlg_group_node component of OpenLink Virtuoso Open Source version 7.2.11. This issue allows attackers to disrupt service by executing crafted SQL statements that cause the application to crash.

Impact

Exploitation of this vulnerability leads to a denial-of-service condition, causing the Virtuoso server to crash and become unresponsive.

Reproduction

The vulnerability can be reproduced by running a crafted SQL query that exploits the sqlg_group_node component. This can be done using the OpenLink Virtuoso Docker image. After starting the Virtuoso server, the SQL query can be executed through the isql command-line interface, which will cause the server to crash.

Remediation

Users can upgrade to the latest version of OpenLink Virtuoso to address this vulnerability.