Vulnerability advisory
CVE-2024-27304
pgx SQL Injection via Protocol Message Size Overflow
Also known as GHSA-7jwh-3vrq-q3m8GHSA-mrww-27vc-gghvGO-2024-2606
Severity
- CVSS 3.x
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected versions
Repository
| Affected commits | Fixed by commit |
|---|---|
| GIT github.com/jackc/pgproto3 ↗ | |
| All commits before 945c2126f6db8f3bea7eeebe307c01fe92bca007 | 945c2126f6db8f3bea7eeebe307c01fe92bca007 |
| GIT github.com/jackc/pgx ↗ | |
| All commits before 14690df4c533758df97f7cc561cb9062155045c6 | 14690df4c533758df97f7cc561cb9062155045c6 |
| 4fc4f9a60337af3bd7c6abdf6c71460712d112fc to before da6f2c98f2664b215b40b1606551fdfcc7f3ea5c | da6f2c98f2664b215b40b1606551fdfcc7f3ea5c |
| Not specified | adbb38f298c76e283ffc7c7a3f571036fea47fd4 |
| Not specified | c543134753a0c5d22881c12404025724cb05ffd8 |
| Not specified | f94eb0e2f96782042c96801b5ac448f44f0a81df |
Also listed as affected (91)
| |
Description
pgx is a PostgreSQL driver and toolkit for Go. SQL injection can occur if an attacker can cause a single query or bind message to exceed 4 GB in size. An integer overflow in the calculated message size can cause the one large message to be sent as multiple messages under the attacker's control. The problem is resolved in v4.18.2 and v5.5.4. As a workaround, reject user input large enough to cause a single query or bind message to exceed 4 GB in size.
References
- Webwww.youtube.com/watch?v=Tfg1B8u1yvE ↗
- Advisorygithub.com/CVEProject/cvelistV5/tree/main/cves/2024/27xxx/CVE-2024-27304.json ↗
- Advisorygithub.com/jackc/pgproto3/security/advisories/GHSA-7jwh-3vrq-q3m8 ↗
- Advisorygithub.com/jackc/pgx/security/advisories/GHSA-mrww-27vc-gghv ↗
- Advisorynvd.nist.gov/vuln/detail/CVE-2024-27304 ↗
- Fixgithub.com/jackc/pgproto3/commit/945c2126f6db8f3bea7eeebe307c01fe92bca007 ↗
- Fixgithub.com/jackc/pgx/commit/adbb38f298c76e283ffc7c7a3f571036fea47fd4 ↗
- Fixgithub.com/jackc/pgx/commit/c543134753a0c5d22881c12404025724cb05ffd8 ↗
- Fixgithub.com/jackc/pgx/commit/f94eb0e2f96782042c96801b5ac448f44f0a81df ↗