Critical SQL Injection Vulnerability in libpgjava Package
Summary
UBUNTU-CVE-2024-1597: pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE. Affects libpgjava versions 9.2-1002-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libpgjava is a Java library that provides connectivity to PostgreSQL databases. It is widely used in applications that require database interactions. The library facilitates the execution of SQL queries and transactions, making it essential for developers working with PostgreSQL. However, a recent vulnerability has been identified that could allow attackers to exploit SQL injection flaws under specific conditions.
Vulnerability Detail
The vulnerability, identified as CVE-2024-1597, allows an attacker to inject SQL commands when using the PreferQueryMode=SIMPLE setting in the pgjdbc driver. This is not the default mode, but if enabled, it can lead to severe security risks. The attacker can craft a payload that manipulates SQL queries, bypassing the protections offered by parameterized queries. This vulnerability affects versions prior to 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9, and 42.2.28, with a CVSS score of 10.0, indicating critical severity.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating the package is not immediately possible, consider disabling the PreferQueryMode=SIMPLE setting in your application to mitigate the risk of SQL injection. This can be done by ensuring that your database connection settings do not include this mode.
Conclusion
The libpgjava package has a critical vulnerability (CVE-2024-1597) that can lead to SQL injection attacks if specific settings are enabled. It is crucial to update to the latest patched version to mitigate this risk. Users should also consider disabling the vulnerable setting as a temporary workaround.
See every vulnerability recorded for libpgjava →
FAQ
CVE-2024-1597 is a critical vulnerability in the libpgjava package that allows SQL injection attacks under specific configurations.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
If exploited, this vulnerability can allow attackers to manipulate SQL queries, potentially leading to unauthorized data access or data corruption.
Yes, the default mode of the pgjdbc driver does not expose this vulnerability. The issue arises only when PreferQueryMode=SIMPLE is enabled.
If an immediate update is not feasible, disable the PreferQueryMode=SIMPLE setting in your database connection to reduce the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for libpgjava.
