kritisch

CVE-2024-1597

pgjdbc: PostgreSQL JDBC Driver allows attacker to inject SQL if using PreferQueryMode=SIMPLE

Veröffentlicht 19. Feb. 2024Geändert 17. Juni 2026CWE 89

In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.

Einstufung nach Quelle

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

GHSA10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Red Hat9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Bitnami10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Trivys eigenes Label ist CRITICAL. Kritisch laut NVD, GHSA, Bitnami. Niedriger laut Red Hat (hoch), AlmaLinux (hoch), Oracle (hoch), Rocky Linux (hoch), Ubuntu (mittel).

Beschreibung

pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE. Note this is not the default. In the default mode there is no vulnerability. A placeholder for a numeric value must be immediately preceded by a minus. There must be a second placeholder for a string value after the first placeholder; both must be on the same line. By constructing a matching string payload, the attacker can inject SQL to alter the query,bypassing the protections that parameterized queries bring against SQL Injection attacks. Versions before 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9, and 42.2.28 are affected.

Betroffene Pakete und behobene Versionen

Quelle	Paket	Behoben in
bitnami::Bitnami Vulnerability Database	postgresql-jdbc-driver	42.2.28, 42.3.9, 42.4.4, 42.5.5, 42.6.1, 42.7.2
maven::GitHub Security Advisory Maven	org.postgresql:postgresql	42.2.28, 42.3.9, 42.4.4, 42.5.5, 42.6.1, 42.7.2
alma 8	postgresql-jdbc, postgresql-jdbc-javadoc	42.2.14-3.el8_9
alma 9	postgresql-jdbc	42.2.28-1.el9_3
alpine 3.19	java-postgresql-jdbc	42.6.2-r0
alpine 3.20	java-postgresql-jdbc	42.6.2-r0
alpine 3.21	java-postgresql-jdbc	42.6.2-r0
alpine 3.22	java-postgresql-jdbc	42.6.2-r0
alpine 3.23	java-postgresql-jdbc	42.6.2-r0
alpine 3.24	java-postgresql-jdbc	42.6.2-r0
alpine edge	java-postgresql-jdbc	42.6.2-r0
chainguard	dependency-track, keycloak, mariadb-10.11 und 3 weitere	4.10.1-r1 und 5 weitere

Alle 43 Einträge aus 27 Quellen zeigen

Quelle	Paket	Behoben in
bitnami::Bitnami Vulnerability Database	postgresql-jdbc-driver	42.2.28, 42.3.9, 42.4.4, 42.5.5, 42.6.1, 42.7.2
maven::GitHub Security Advisory Maven	org.postgresql:postgresql	42.2.28, 42.3.9, 42.4.4, 42.5.5, 42.6.1, 42.7.2
alma 8	postgresql-jdbc	42.2.14-3.el8_9
alma 8	postgresql-jdbc-javadoc	42.2.14-3.el8_9
alma 9	postgresql-jdbc	42.2.28-1.el9_3
alpine 3.19	java-postgresql-jdbc	42.6.2-r0
alpine 3.20	java-postgresql-jdbc	42.6.2-r0
alpine 3.21	java-postgresql-jdbc	42.6.2-r0
alpine 3.22	java-postgresql-jdbc	42.6.2-r0
alpine 3.23	java-postgresql-jdbc	42.6.2-r0
alpine 3.24	java-postgresql-jdbc	42.6.2-r0
alpine edge	java-postgresql-jdbc	42.6.2-r0
chainguard	dependency-track	4.10.1-r1
chainguard	keycloak	23.0.7-r0
chainguard	mariadb-10.11	10.11.8-r2
chainguard	mariadb-10.6	10.6.17-r0
chainguard	mariadb-11.2	11.2.3-r2
chainguard	trino	439-r2
debian 10	libpgjava	42.2.5-2+deb10u4
debian 11	libpgjava	42.2.15-1+deb11u2
debian 12	libpgjava	42.5.5-0+deb12u1
debian 13	libpgjava	42.7.2-1
debian 14	libpgjava	42.7.2-1
echo	libpgjava	42.5.5-0+deb12u1
minimos	mariadb-10.11	10.11.11-r1
minimos	mariadb-10.5	10.5.28-r1
minimos	mariadb-10.6	10.6.21-r1
Oracle Linux 8	postgresql-jdbc	42.2.14-3.el8_9
Oracle Linux 8	postgresql-jdbc-javadoc	42.2.14-3.el8_9
Oracle Linux 9	postgresql-jdbc	42.2.28-1.el9_3
rapidfort Oracle Linux 9	postgresql-jdbc	0:42.2.28-1.el9_3
Red Hat	libreoffice:flatpak::postgresql-jdbc	kein Fix angegeben
Red Hat	libreoffice:flatpak::postgresql-jdbc-javadoc	kein Fix angegeben
rocky 8	postgresql-jdbc	42.2.14-3.el8_9
rocky 8	postgresql-jdbc-javadoc	42.2.14-3.el8_9
rocky 9	postgresql-jdbc	42.2.28-1.el9_3
ubuntu 18.04-ESM	libpgjava	kein Fix angegeben
wolfi	dependency-track	4.10.1-r1
wolfi	keycloak	23.0.7-r0
wolfi	mariadb-10.11	10.11.8-r2
wolfi	mariadb-10.6	10.6.17-r0
wolfi	mariadb-11.2	11.2.3-r2
wolfi	trino	439-r2

Referenzen

Alle 30 Referenzen