This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] PostgreSQL pgJDBC and EDB pgJDBC fix a critical vulnerability

PostgreSQL JDBC driver - SQL injection (CVE-2024-1597)
CVSS 10.0 (Critical)

An unauthenticated remote attacker can inject SQL code when the PreferQueryMode=SIMPLE mode is used in pgjdbc, the PostgreSQL JDBC driver. The attacker can use a specific payload construction to modify the query, thereby bypassing the standard protection against SQL injection attacks offered by parameterized queries. This vulnerability does not occur when the default settings are used [1] [2].

The vulnerability is present in products:

  • pgJDBC; >=42.2.0, <42.2.28; >=42.3.0, <42.3.9; >=42.4.0, <42.4.4; >=42.5.0, <42.5.5; >=42.6.0, <42.6.1; >=42.7.0, <42.7.2
  • EnterpriseDB pgJDBC; >=42.5.4.0, <42.5.4.2

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 3. 4. 2024.

PostgreSQL pgJDBC versions 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9, 42.2.28 and EDB pgJDBC version 42.5.4.2 fix a critical vulnerability [3].

By CESNET, z.s.p.o. Michaela Jarošová on 4. 4. 2024.

CESNET, z.s.p.o. Logo