SQL Injection Vulnerability in PostgreSQL JDBC Driver
Summary
CVE-2024-1597: pgjdbc SQL Injection via line comment generation. Affects postgresql-jdbc-driver across 6 version ranges.
< 42.2.28
>= 42.3.0, < 42.3.9
>= 42.4.0, < 42.4.4
>= 42.5.0, < 42.5.5
>= 42.6.0, < 42.6.1
>= 42.7.0, < 42.7.2
Fixed in 6 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- org.postgresql:postgresql · Maven
- org.postgresql:postgresql · Maven
- libpgjava · Debian:11
The same CVE-2024-1597 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The PostgreSQL JDBC Driver, also known as pgjdbc, is a Java library that allows applications to connect to a PostgreSQL database. It provides functionality for executing SQL queries and managing database connections. The driver is widely used in Java applications that interact with PostgreSQL databases.
Vulnerability Detail
The vulnerability in pgjdbc allows an attacker to inject SQL code when using the PreferQueryMode=SIMPLE option. This option is not enabled by default. The vulnerability arises when a numeric placeholder is immediately preceded by a minus sign, and there is a second placeholder for a string value on the same line. By constructing a specific payload, an attacker can manipulate the query and bypass the protection provided by parameterized queries, leading to potential SQL injection attacks. Versions prior to 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9, and 42.2.8 of the driver are affected.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 42.2.2842.2.28 -
>= 42.3.0, < 42.3.942.3.9 -
>= 42.4.0, < 42.4.442.4.4 -
>= 42.5.0, < 42.5.542.5.5 -
>= 42.6.0, < 42.6.142.6.1 -
>= 42.7.0, < 42.7.242.7.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a workaround is to avoid using the PreferQueryMode=SIMPLE option. Stick to the default mode or choose a different query mode that does not exhibit this vulnerability.
Conclusion
The SQL injection vulnerability in the PostgreSQL JDBC Driver can be mitigated by upgrading to the latest version or avoiding the vulnerable query mode. It is crucial to keep the driver up to date to ensure the security of applications that use it. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for postgresql-jdbc-driver →
FAQ
pgjdbc is the PostgreSQL JDBC Driver, a Java library for connecting to PostgreSQL databases.
SQL injection is a type of security vulnerability where an attacker can manipulate SQL queries by injecting malicious code, potentially leading to unauthorized access or data manipulation.
No, the vulnerability is only present in versions prior to 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9, and 42.2.8 of the PostgreSQL JDBC Driver.
The vulnerability allows an attacker to bypass the protection provided by parameterized queries, potentially leading to SQL injection attacks and unauthorized access to the database.
There are no known public exploits of this vulnerability at the moment.
Related vulnerabilities
Recent vulnerabilities recorded for postgresql-jdbc-driver.
