SQL Injection Vulnerability in libpgjava: PostgreSQL JDBC Driver
Summary
DEBIAN-CVE-2024-1597: pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE. Affects libpgjava versions < 42.2.15-1+deb11u2. Fixed in 42.2.15-1+deb11u2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libpgjava is the PostgreSQL JDBC Driver that enables Java applications to interact with PostgreSQL databases. It provides a means for Java developers to execute SQL queries and manage database connections seamlessly. However, certain configurations can expose the driver to SQL injection vulnerabilities, particularly when using the PreferQueryMode=SIMPLE setting, which is not the default mode.
Vulnerability Detail
The vulnerability arises from the way pgjdbc handles SQL queries when the PreferQueryMode is set to SIMPLE. This configuration allows an attacker to inject SQL commands if specific conditions are met, such as having a numeric placeholder immediately followed by a minus sign and a string placeholder on the same line. This flaw can lead to unauthorized data manipulation and compromise the integrity of the database. Versions prior to 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9, and 42.2.28 are affected by this vulnerability.
How To Fix
Minimum fixed version
42.2.15-1+deb11u2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libpgjavaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the PreferQueryMode=SIMPLE setting in your application. Instead, use the default query mode or ensure that your SQL queries do not meet the conditions that allow for injection.
Conclusion
The libpgjava package is vulnerable to SQL injection when configured with the PreferQueryMode=SIMPLE. It is crucial to update to the latest patched versions to mitigate this risk. Additionally, using Vulert can help monitor and identify vulnerabilities in your software effectively.
See every vulnerability recorded for libpgjava →
FAQ
PreferQueryMode is a configuration setting in libpgjava that determines how SQL queries are processed. The SIMPLE mode can expose the application to SQL injection vulnerabilities.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
An attacker can manipulate SQL queries, potentially leading to unauthorized access, data corruption, or loss of data integrity.
No, this vulnerability affects specific versions of libpgjava prior to 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9, and 42.2.28.
If immediate updates are not possible, ensure that your application does not use the vulnerable PreferQueryMode=SIMPLE setting as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for libpgjava.
