CVE-2024-1597: PostgreSQL JDBC Driver SQL Injection Vulnerability
Summary
CVE-2024-1597: pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE. Affects libpgjava across 2 version ranges.
< 42.2.15-1+deb11u2
< 990d63f6be401ab40de5eb303a75924c9e71903c
Fixed in 42.2.15-1+deb11u2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pgjdbc is the official JDBC driver for PostgreSQL, enabling Java applications to interact with PostgreSQL databases. It supports various features such as connection pooling, transaction management, and advanced data types. However, certain configurations can expose it to SQL injection vulnerabilities, particularly when using the PreferQueryMode=SIMPLE setting, which is not the default mode.
Vulnerability Detail
The vulnerability arises from the way pgjdbc handles SQL queries when the PreferQueryMode is set to SIMPLE. An attacker can exploit this by crafting a specific payload that includes a numeric placeholder immediately followed by a minus sign, and a string placeholder on the same line. This allows the attacker to inject malicious SQL code, potentially altering the intended database query and bypassing the protections offered by parameterized queries. The affected versions include those prior to 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9, and 42.2.28.
How To Fix
Minimum fixed version
42.2.15-1+deb11u2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libpgjavaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, consider disabling the PreferQueryMode=SIMPLE setting in your application configuration to mitigate the risk of SQL injection until you can apply the fix.
Conclusion
CVE-2024-1597 presents a significant risk to applications using the PostgreSQL JDBC Driver under certain configurations. It is crucial to upgrade to the latest version to mitigate this vulnerability and ensure the security of your database interactions.
See every vulnerability recorded for libpgjava →
FAQ
CVE-2024-1597 is a vulnerability in the PostgreSQL JDBC Driver that allows SQL injection attacks when using a specific query mode.
Versions before 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9, and 42.2.28 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score for CVE-2024-1597 is 9.8, indicating a critical level of severity.
If immediate upgrading is not feasible, disable the PreferQueryMode=SIMPLE setting as a temporary workaround to reduce the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for libpgjava.
