Duplicate Advisory: SQL injection in pgjdbc
Critical severity
GitHub Reviewed
Published
Feb 19, 2024
to the GitHub Advisory Database
•
Updated Jun 10, 2024
Withdrawn
This advisory was withdrawn on Feb 21, 2024
Package
Affected versions
>= 42.7.0, < 42.7.2
>= 42.6.0, < 42.6.1
>= 42.5.0, < 42.5.5
>= 42.4.0, < 42.4.4
>= 42.3.0, < 42.3.9
< 42.2.8
Patched versions
42.7.2
42.6.1
42.5.5
42.4.4
42.3.9
42.2.8
Description
Published by the National Vulnerability Database
Feb 19, 2024
Published to the GitHub Advisory Database
Feb 19, 2024
Reviewed
Feb 21, 2024
Withdrawn
Feb 21, 2024
Last updated
Jun 10, 2024
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-24rp-q3w6-vc56. This link is maintained to preserve external references.
Original Description
pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE. Note this is not the default. In the default mode there is no vulnerability. A placeholder for a numeric value must be immediately preceded by a minus. There must be a second placeholder for a string value after the first placeholder; both must be on the same line. By constructing a matching string payload, the attacker can inject SQL to alter the query,bypassing the protections that parameterized queries bring against SQL Injection attacks. Versions before 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9, and 42.2.8 are affected.
References