The psqlODBC team has released version 18.00.0005 of psqlODBC, the official ODBC driver for PostgreSQL. This release fixes one security vulnerability and two bugs. All users should upgrade.
CVSS 3.1 base score: 5.9 (Medium)
Versions affected: 08.01.0102 through 18.00.0004.
psqlODBC stored the number of bound parameters on a statement in a signed 16-bit field. When an application bound more than 32768 parameters on one statement, the driver wrote zeros outside the memory that holds the parameter bindings. The application could crash, or keep running with corrupted memory. An application is exposed if it lets untrusted input decide how many parameters it binds, for example by building an IN (?, ?, ...) list from user-supplied values.
SQLBindParameter now rejects parameter numbers above 32767 with SQLSTATE 07009. ODBC cannot report more than 32767 parameters, because SQLNumParams and SQL_DESC_COUNT are 16-bit values. No earlier release could run a statement with more than 32767 parameters, so this change does not break any application that worked before.
If you cannot upgrade right away, limit the number of parameters your application builds from external input, or pass long value lists as a single array parameter, for example = ANY(?).
The psqlODBC team thanks Richard Kuesters for reporting this problem.
For more details, see the advisory GHSA-cmfx-rm3r-p2jr.
type "timestam" does not exist. From parameter 1000 on, the driver cut the type name that follows each parameter to fit a fixed-size buffer.bytea parameters failed with "Type is invalid" when used through Microsoft's OLE DB Provider for ODBC (MSDASQL), for example from ADO.The Windows packages are now built with OpenSSL 3.5.9.
Windows installers and merge modules for x86, x64 and ARM64 are available from the PostgreSQL download site and from the GitHub release page. The source code is on GitHub.
The full list of changes is in the release notes.
Please report bugs on the psqlODBC issue tracker or the pgsql-odbc mailing list.