Skip to content

Non-authorized (without secret key) access to encrypted database using execute statement on external.

High
AlexPeshkoff published GHSA-fx9r-rj68-7p69 Aug 15, 2025

Package

All firebird versions starting with 4.0.0.

Affected versions

<= 4.0.7, <= 5.0.3

Patched versions

Equal or greater than: 6.0.0.609, 5.0.2.1610, 4.0.6.3183

Description

Impact

Connections stored in ExtConnPool are not verified for presence and suitability of CryptCallback interface used when they were created vs actually available currently. Additional problem with vulnerability is that use of inappropriate CryptCallback interface may cause segfault in server process.
To be impacted by this vulnerability one should use ExtConnPool (i.e. set to non-zero parameter ExtConnPoolSize in firebird.conf). Encrypted database, accessed by execute statement on external, may be accessed later by attachment missing a key to that database. In a case when execute statement are chained segfault may happen. What is worse that segfault may take place even for unencrypted databases.

Patches

Currently one can use the following or later snapshots:

  • 6.0.0.609
  • 5.0.2.1610
  • 4.0.6.3183
    or point releases:
  • 5.0.2
  • 4.0.6
    Present in them fix for #8429 also fixes this GHSA.

Workarounds

Set
ExtConnPoolSize=0
in firebird.conf. This is default value - i.e. if you never tuned it you are not impacted.

Severity

High

CVSS overall score

This score calculates overall vulnerability severity from 0 to 10 and is based on the Common Vulnerability Scoring System (CVSS).
/ 10

CVSS v3 base metrics

Attack vector
Network
Attack complexity
High
Privileges required
Low
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
Low

CVSS v3 base metrics

Attack vector: More severe the more the remote (logically and physically) an attacker can be in order to exploit the vulnerability.
Attack complexity: More severe for the least complex attacks.
Privileges required: More severe if no privileges are required.
User interaction: More severe when no user interaction is required.
Scope: More severe when a scope change occurs, e.g. one vulnerable component impacts resources in components beyond its security scope.
Confidentiality: More severe when loss of data confidentiality is highest, measuring the level of data access available to an unauthorized user.
Integrity: More severe when loss of data integrity is the highest, measuring the consequence of data modification possible by an unauthorized user.
Availability: More severe when the loss of impacted component availability is highest.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L

CVE ID

CVE-2025-24975

Weaknesses

No CWEs