CVE-2019-15658: SQL Injection in connect-pg-simple
Summary
CVE-2019-15658: SQL Injection in connect-pg-simple. Affects connect-pg-simple versions < 6.0.1. Fixed in 6.0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
connect-pg-simple is an npm package that provides session storage for the connect/express framework using PostgreSQL. It allows users to store session data in a PostgreSQL database. This vulnerability affects versions prior to 6.0.1.
Vulnerability Detail
The vulnerability in connect-pg-simple is an SQL injection that occurs when unsanitized table or schema names are used as input. This can lead to unauthorized access or modification of the database. The impact of this vulnerability is considered low, but it is still important to upgrade to version 6.0.1 to mitigate the risk.
How To Fix
Minimum fixed version
6.0.1
This is the first release that contains the fix.
npm install connect-pg-simple@6.0.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If it is not possible to immediately upgrade to version 6.0.1, a workaround is to sanitize and escape the input for the tableName and schemaName options before passing them to the constructor. However, it is important to note that this workaround should be removed once the package is updated to version 6.0.1 or later to avoid double escaping.
Conclusion
In conclusion, the SQL injection vulnerability in connect-pg-simple can be mitigated by upgrading to version 6.0.1. If immediate upgrade is not possible, sanitizing and escaping the input can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for connect-pg-simple →
FAQ
connect-pg-simple is an npm package that provides session storage for the connect/express framework using PostgreSQL.
The impact of this vulnerability is considered low, but it can lead to unauthorized access or modification of the database.
To fix this vulnerability, you should upgrade to version 6.0.1 of connect-pg-simple.
Yes, if you cannot immediately upgrade, you can sanitize and escape the input for the affected options.
You can find more information in the security issue disclosure on the GitHub repository.
