Important: postgresql-jdbc security update
Summary
ALSA-2024:1435: Important: postgresql-jdbc security update. Affects postgresql-jdbc versions < 42.2.14-3.el8_9. Fixed in 42.2.14-3.el8_9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
PostgreSQL is an advanced object-relational database management system. The postgresql-jdbc package includes the .jar files needed for Java programs to access a PostgreSQL database.
Vulnerability Detail
The PostgreSQL JDBC Driver allows an attacker to inject SQL if using PreferQueryMode=SIMPLE. This vulnerability, identified as CVE-2024-1597, can have serious consequences as it enables unauthorized access and manipulation of the database. It is important to address this vulnerability promptly to prevent potential data breaches and unauthorized actions.
How To Fix
Minimum fixed version
42.2.14-3.el8_9
This is the first release that contains the fix.
sudo dnf update postgresql-jdbcTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is crucial to update the package to the fixed version as soon as possible.
Conclusion
In conclusion, it is crucial to update the postgresql-jdbc package to the fixed version 42.2.14-3.el8_9 or later to address the SQL injection vulnerability. Failure to do so may result in unauthorized access and manipulation of the database. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for postgresql-jdbc →
FAQ
PostgreSQL is an advanced object-relational database management system known for its robustness, scalability, and extensibility.
The postgresql-jdbc package provides the necessary .jar files for Java programs to connect and interact with a PostgreSQL database.
SQL injection is a type of vulnerability that allows an attacker to manipulate SQL queries by injecting malicious code. This can lead to unauthorized access, data breaches, and other security issues.
CVE-2024-1597 is the identifier for the specific vulnerability in the PostgreSQL JDBC Driver that allows SQL injection when using PreferQueryMode=SIMPLE.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
Related vulnerabilities
Recent vulnerabilities recorded for postgresql-jdbc.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
