kritik

CVE-2024-1597

pgjdbc: PostgreSQL JDBC Driver allows attacker to inject SQL if using PreferQueryMode=SIMPLE

Yayın 19 Şub 2024Değişiklik 17 Haz 2026CWE 89

En geç 24 Eki 2026, 07:11 UTC tarihinden beri Trivy database'indeO derlemeden önce ne zaman girdiği kayıtlı değil.

Kaynağa göre önem derecesi

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

GHSA10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Red Hat9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Bitnami10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD, GHSA, Bitnami. Daha düşük diyenler: Red Hat (yüksek), AlmaLinux (yüksek), Oracle (yüksek), Rocky Linux (yüksek), Ubuntu (orta).

Açıklama

pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE. Note this is not the default. In the default mode there is no vulnerability. A placeholder for a numeric value must be immediately preceded by a minus. There must be a second placeholder for a string value after the first placeholder; both must be on the same line. By constructing a matching string payload, the attacker can inject SQL to alter the query,bypassing the protections that parameterized queries bring against SQL Injection attacks. Versions before 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9, and 42.2.28 are affected.

Etkilenen paketler ve düzeltilmiş sürümler

Kaynak	Paket	Düzeltildiği sürüm
bitnami::Bitnami Vulnerability Database	postgresql-jdbc-driver	42.2.28, 42.3.9, 42.4.4, 42.5.5, 42.6.1, 42.7.2
maven::GitHub Security Advisory Maven	org.postgresql:postgresql	42.2.28, 42.3.9, 42.4.4, 42.5.5, 42.6.1, 42.7.2
alma 8	postgresql-jdbc, postgresql-jdbc-javadoc	42.2.14-3.el8_9
alma 9	postgresql-jdbc	42.2.28-1.el9_3
alpine 3.19	java-postgresql-jdbc	42.6.2-r0
alpine 3.20	java-postgresql-jdbc	42.6.2-r0
alpine 3.21	java-postgresql-jdbc	42.6.2-r0
alpine 3.22	java-postgresql-jdbc	42.6.2-r0
alpine 3.23	java-postgresql-jdbc	42.6.2-r0
alpine 3.24	java-postgresql-jdbc	42.6.2-r0
alpine edge	java-postgresql-jdbc	42.6.2-r0
chainguard	dependency-track, keycloak, mariadb-10.11 ve 3 tane daha	4.10.1-r1 ve 5 tane daha

27 kaynaktaki 43 kaydın hepsini göster

Kaynak	Paket	Düzeltildiği sürüm
bitnami::Bitnami Vulnerability Database	postgresql-jdbc-driver	42.2.28, 42.3.9, 42.4.4, 42.5.5, 42.6.1, 42.7.2
maven::GitHub Security Advisory Maven	org.postgresql:postgresql	42.2.28, 42.3.9, 42.4.4, 42.5.5, 42.6.1, 42.7.2
alma 8	postgresql-jdbc	42.2.14-3.el8_9
alma 8	postgresql-jdbc-javadoc	42.2.14-3.el8_9
alma 9	postgresql-jdbc	42.2.28-1.el9_3
alpine 3.19	java-postgresql-jdbc	42.6.2-r0
alpine 3.20	java-postgresql-jdbc	42.6.2-r0
alpine 3.21	java-postgresql-jdbc	42.6.2-r0
alpine 3.22	java-postgresql-jdbc	42.6.2-r0
alpine 3.23	java-postgresql-jdbc	42.6.2-r0
alpine 3.24	java-postgresql-jdbc	42.6.2-r0
alpine edge	java-postgresql-jdbc	42.6.2-r0
chainguard	dependency-track	4.10.1-r1
chainguard	keycloak	23.0.7-r0
chainguard	mariadb-10.11	10.11.8-r2
chainguard	mariadb-10.6	10.6.17-r0
chainguard	mariadb-11.2	11.2.3-r2
chainguard	trino	439-r2
debian 10	libpgjava	42.2.5-2+deb10u4
debian 11	libpgjava	42.2.15-1+deb11u2
debian 12	libpgjava	42.5.5-0+deb12u1
debian 13	libpgjava	42.7.2-1
debian 14	libpgjava	42.7.2-1
echo	libpgjava	42.5.5-0+deb12u1
minimos	mariadb-10.11	10.11.11-r1
minimos	mariadb-10.5	10.5.28-r1
minimos	mariadb-10.6	10.6.21-r1
Oracle Linux 8	postgresql-jdbc	42.2.14-3.el8_9
Oracle Linux 8	postgresql-jdbc-javadoc	42.2.14-3.el8_9
Oracle Linux 9	postgresql-jdbc	42.2.28-1.el9_3
rapidfort Oracle Linux 9	postgresql-jdbc	0:42.2.28-1.el9_3
Red Hat	libreoffice:flatpak::postgresql-jdbc	düzeltme belirtilmemiş
Red Hat	libreoffice:flatpak::postgresql-jdbc-javadoc	düzeltme belirtilmemiş
rocky 8	postgresql-jdbc	42.2.14-3.el8_9
rocky 8	postgresql-jdbc-javadoc	42.2.14-3.el8_9
rocky 9	postgresql-jdbc	42.2.28-1.el9_3
ubuntu 18.04-ESM	libpgjava	düzeltme belirtilmemiş
wolfi	dependency-track	4.10.1-r1
wolfi	keycloak	23.0.7-r0
wolfi	mariadb-10.11	10.11.8-r2
wolfi	mariadb-10.6	10.6.17-r0
wolfi	mariadb-11.2	11.2.3-r2
wolfi	trino	439-r2

Referanslar

30 referansın hepsi