critical

CVE-2024-1597

pgjdbc: PostgreSQL JDBC Driver allows attacker to inject SQL if using PreferQueryMode=SIMPLE

Published 19 Feb 2024Modified 17 Jun 2026CWE 89

In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.

Severity by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

GHSA10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Red Hat9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Bitnami10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Trivy's own label is CRITICAL. Rated critical by NVD, GHSA, Bitnami. Rated lower by Red Hat (high), AlmaLinux (high), Oracle (high), Rocky Linux (high), Ubuntu (medium).

Description

pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE. Note this is not the default. In the default mode there is no vulnerability. A placeholder for a numeric value must be immediately preceded by a minus. There must be a second placeholder for a string value after the first placeholder; both must be on the same line. By constructing a matching string payload, the attacker can inject SQL to alter the query,bypassing the protections that parameterized queries bring against SQL Injection attacks. Versions before 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9, and 42.2.28 are affected.

Affected packages and fixed versions

Source	Package	Fixed in
bitnami::Bitnami Vulnerability Database	postgresql-jdbc-driver	42.2.28, 42.3.9, 42.4.4, 42.5.5, 42.6.1, 42.7.2
maven::GitHub Security Advisory Maven	org.postgresql:postgresql	42.2.28, 42.3.9, 42.4.4, 42.5.5, 42.6.1, 42.7.2
alma 8	postgresql-jdbc, postgresql-jdbc-javadoc	42.2.14-3.el8_9
alma 9	postgresql-jdbc	42.2.28-1.el9_3
alpine 3.19	java-postgresql-jdbc	42.6.2-r0
alpine 3.20	java-postgresql-jdbc	42.6.2-r0
alpine 3.21	java-postgresql-jdbc	42.6.2-r0
alpine 3.22	java-postgresql-jdbc	42.6.2-r0
alpine 3.23	java-postgresql-jdbc	42.6.2-r0
alpine 3.24	java-postgresql-jdbc	42.6.2-r0
alpine edge	java-postgresql-jdbc	42.6.2-r0
chainguard	dependency-track, keycloak, mariadb-10.11 and 3 more	4.10.1-r1 and 5 more

Show all 43 entries from 27 sources

Source	Package	Fixed in
bitnami::Bitnami Vulnerability Database	postgresql-jdbc-driver	42.2.28, 42.3.9, 42.4.4, 42.5.5, 42.6.1, 42.7.2
maven::GitHub Security Advisory Maven	org.postgresql:postgresql	42.2.28, 42.3.9, 42.4.4, 42.5.5, 42.6.1, 42.7.2
alma 8	postgresql-jdbc	42.2.14-3.el8_9
alma 8	postgresql-jdbc-javadoc	42.2.14-3.el8_9
alma 9	postgresql-jdbc	42.2.28-1.el9_3
alpine 3.19	java-postgresql-jdbc	42.6.2-r0
alpine 3.20	java-postgresql-jdbc	42.6.2-r0
alpine 3.21	java-postgresql-jdbc	42.6.2-r0
alpine 3.22	java-postgresql-jdbc	42.6.2-r0
alpine 3.23	java-postgresql-jdbc	42.6.2-r0
alpine 3.24	java-postgresql-jdbc	42.6.2-r0
alpine edge	java-postgresql-jdbc	42.6.2-r0
chainguard	dependency-track	4.10.1-r1
chainguard	keycloak	23.0.7-r0
chainguard	mariadb-10.11	10.11.8-r2
chainguard	mariadb-10.6	10.6.17-r0
chainguard	mariadb-11.2	11.2.3-r2
chainguard	trino	439-r2
debian 10	libpgjava	42.2.5-2+deb10u4
debian 11	libpgjava	42.2.15-1+deb11u2
debian 12	libpgjava	42.5.5-0+deb12u1
debian 13	libpgjava	42.7.2-1
debian 14	libpgjava	42.7.2-1
echo	libpgjava	42.5.5-0+deb12u1
minimos	mariadb-10.11	10.11.11-r1
minimos	mariadb-10.5	10.5.28-r1
minimos	mariadb-10.6	10.6.21-r1
Oracle Linux 8	postgresql-jdbc	42.2.14-3.el8_9
Oracle Linux 8	postgresql-jdbc-javadoc	42.2.14-3.el8_9
Oracle Linux 9	postgresql-jdbc	42.2.28-1.el9_3
rapidfort Oracle Linux 9	postgresql-jdbc	0:42.2.28-1.el9_3
Red Hat	libreoffice:flatpak::postgresql-jdbc	no fix listed
Red Hat	libreoffice:flatpak::postgresql-jdbc-javadoc	no fix listed
rocky 8	postgresql-jdbc	42.2.14-3.el8_9
rocky 8	postgresql-jdbc-javadoc	42.2.14-3.el8_9
rocky 9	postgresql-jdbc	42.2.28-1.el9_3
ubuntu 18.04-ESM	libpgjava	no fix listed
wolfi	dependency-track	4.10.1-r1
wolfi	keycloak	23.0.7-r0
wolfi	mariadb-10.11	10.11.8-r2
wolfi	mariadb-10.6	10.6.17-r0
wolfi	mariadb-11.2	11.2.3-r2
wolfi	trino	439-r2

References

All 30 references