You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
pgx is a PostgreSQL driver and toolkit for Go. SQL injection can occur if an attacker can cause a single query or bind message to exceed 4 GB in size. An integer overflow in the calculated message size can cause the one large message to be sent as multiple messages under the attacker's control. The problem is resolved in v4.18.2 and v5.5.4. As a workaround, reject user input large enough to cause a single query or bind message to exceed 4 GB in size.
CVE-2024-27304 - Critical Severity Vulnerability
null
Library home page: https://proxy.golang.org/github.com/jackc/pgproto3/v2/@v/v2.0.6.zip
Path to dependency file: /go.mod
Path to vulnerable library: /go/pkg/mod/cache/download/github.com/jackc/pgproto3/v2/@v/v2.0.6.mod
Dependency Hierarchy:
Found in HEAD commit: 82e1223471134643c1c62f634e9132cd95f308de
Found in base branch: master
pgx is a PostgreSQL driver and toolkit for Go. SQL injection can occur if an attacker can cause a single query or bind message to exceed 4 GB in size. An integer overflow in the calculated message size can cause the one large message to be sent as multiple messages under the attacker's control. The problem is resolved in v4.18.2 and v5.5.4. As a workaround, reject user input large enough to cause a single query or bind message to exceed 4 GB in size.
Publish Date: 2024-03-06
URL: CVE-2024-27304
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-mrww-27vc-gghv
Release Date: 2024-03-06
Fix Resolution: jackc/pgproto3 - v2.3.3, github.com/jackc/pgx - v4.18.2,v5.5.4
The text was updated successfully, but these errors were encountered: