pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE. Note this is not the default. In the default mode there is no vulnerability. A placeholder for a numeric value must be immediately preceded by a minus. There must be a second placeholder for a string value after the first placeholder; both must be on the same line. By constructing a matching string payload, the attacker can inject SQL to alter the query,bypassing the protections that parameterized queries bring against SQL Injection attacks. Versions before 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9, and 42.2.28 are affected.
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
History
10 Jun 2024, 17:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
01 May 2024, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
19 Apr 2024, 07:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
18 Apr 2024, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | (en) pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE. Note this is not the default. In the default mode there is no vulnerability. A placeholder for a numeric value must be immediately preceded by a minus. There must be a second placeholder for a string value after the first placeholder; both must be on the same line. By constructing a matching string payload, the attacker can inject SQL to alter the query,bypassing the protections that parameterized queries bring against SQL Injection attacks. Versions before 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9, and 42.2.28 are affected. |
25 Mar 2024, 16:42
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-24rp-q3w6-vc56 - Third Party Advisory | |
| References | () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TZQTSMESZD2RJ5XBPSXH3TIQVUW5DIUU/ - Mailing List, Third Party Advisory | |
| References | () https://www.enterprisedb.com/docs/jdbc_connector/latest/01_jdbc_rel_notes/ - Release Notes | |
| References | () https://www.enterprisedb.com/docs/security/assessments/cve-2024-1597/ - Third Party Advisory | |
| First Time |
Fedoraproject fedora
Postgresql postgresql Jdbc Driver Fedoraproject Postgresql |
|
| CPE | cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:* cpe:2.3:a:postgresql:postgresql_jdbc_driver:*:*:*:*:*:*:*:* |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
23 Mar 2024, 03:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
28 Feb 2024, 02:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
19 Feb 2024, 13:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-02-19 13:15
Updated : 2024-06-10 17:16
NVD link : CVE-2024-1597
Mitre link : CVE-2024-1597
CVE.ORG link : CVE-2024-1597
JSON object : View
Products Affected
fedoraproject
- fedora
postgresql
- postgresql_jdbc_driver
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')