CVE-2024-27304GHSA-7JWH-3VRQ-Q3M8GHSA-MRWW-27VC-GGHVGO-2024-2606
pgx SQL Injection via Protocol Message Size Overflow
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 4.18.2, 5.5.4, 2.3.3
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- 1 proof of concept on GitHub
CISA's decision points: whether it is exploited, whether attacks can be automated, and how much control an attacker gets. Assessed (SSVC 2.0.3).What do these mean? →
- Exploitation: none
- Automatable: yes
- Technical impact: partial
Summary
pgx is a PostgreSQL driver and toolkit for Go. SQL injection can occur if an attacker can cause a single query or bind message to exceed 4 GB in size. An integer overflow in the calculated message size can cause the one large message to be sent as multiple messages under the attacker's control. The problem is resolved in v4.18.2 and v5.5.4. As a workaround, reject user input large enough to cause a single query or bind message to exceed 4 GB in size.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: yes · Technical impact: partial
- Record last updated
Affected versions
- jackc pgx
fixed in 4.18.2; From 5.0.0 · fixed in 5.5.4
- github.com/jackc/pgproto3Go
fixed in 2.3.3
- github.com/jackc/pgproto3/v2Go
fixed in 2.3.3
- github.com/jackc/pgxGo
All versions
- github.com/jackc/pgx/v4Go
fixed in 4.18.2
- github.com/jackc/pgx/v5Go
From 5.0.0 · fixed in 5.5.4
- github.com/jackc/pgxGo
fixed in 4.18.2
- github.com/jackc/pgxGo
From 5.0.0 · fixed in 5.5.4