Elastic Packetbeat PostgreSQL Protocol Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in Elastic Packetbeat versions 8.0.0 prior to 8.19.10 and 9.0.0 prior to 9.2.4. The issue arises from improper validation of array indices in the PostgreSQL protocol parser, which can be exploited by sending specially crafted packets. This manipulation causes a runtime panic in Go, terminating the Packetbeat process. The vulnerability requires the PostgreSQL protocol to be enabled and configured to monitor traffic on the targeted port.

Impact

Exploitation of this vulnerability leads to a Go runtime panic, causing the Packetbeat process to terminate.

Remediation

Users can upgrade to Packetbeat versions 8.19.11 or 9.2.5 to address this vulnerability. For those unable to upgrade, the PostgreSQL protocol parser can be disabled by removing or commenting out the PostgreSQL configuration in 'packetbeat.yml'.