GHSA-xfg6-62px-cxc2: Duplicate Advisory: SQL injection in pgjdbc
This advisory was withdrawn on Feb 21, 2024. The publisher no longer considers it a valid vulnerability.
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-24rp-q3w6-vc56. This link is maintained to preserve external references. Original Description pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE. Note this is not the default. In the default mode there is no vulnerability.
Published Feb 19, 2024 · Updated Mar 20, 2026
Affected packages
org.postgresql:postgresql
- Ecosystem
- Maven
- Affected
- >= 42.7.0, < 42.7.2
- Fixed in
- 42.7.2
- Check
mvn dependency:tree -Dincludes=org.postgresql:postgresql
org.postgresql:postgresql
- Ecosystem
- Maven
- Affected
- >= 42.6.0, < 42.6.1
- Fixed in
- 42.6.1
- Check
mvn dependency:tree -Dincludes=org.postgresql:postgresql
org.postgresql:postgresql
- Ecosystem
- Maven
- Affected
- >= 42.5.0, < 42.5.5
- Fixed in
- 42.5.5
- Check
mvn dependency:tree -Dincludes=org.postgresql:postgresql
org.postgresql:postgresql
- Ecosystem
- Maven
- Affected
- >= 42.4.0, < 42.4.4
- Fixed in
- 42.4.4
- Check
mvn dependency:tree -Dincludes=org.postgresql:postgresql
org.postgresql:postgresql
- Ecosystem
- Maven
- Affected
- >= 42.3.0, < 42.3.9
- Fixed in
- 42.3.9
- Check
mvn dependency:tree -Dincludes=org.postgresql:postgresql
org.postgresql:postgresql
- Ecosystem
- Maven
- Affected
- < 42.2.8
- Fixed in
- 42.2.8
- Check
mvn dependency:tree -Dincludes=org.postgresql:postgresql
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-24rp-q3w6-vc56. This link is maintained to preserve external references.
Original Description
pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE. Note this is not the default. In the default mode there is no vulnerability. A placeholder for a numeric value must be immediately preceded by a minus. There must be a second placeholder for a string value after the first placeholder; both must be on the same line. By constructing a matching string payload, the attacker can inject SQL to alter the query,bypassing the protections that parameterized queries bring against SQL Injection attacks. Versions before 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9, and 42.2.8 are affected.
References
- https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-24rp-q3w6-vc56
- https://nvd.nist.gov/vuln/detail/CVE-2024-1597
- https://github.com/pgjdbc/pgjdbc/commit/06abfb78a627277a580d4df825f210e96a4e14ee
- https://github.com/pgjdbc/pgjdbc/commit/93b0fcb2711d9c1e3a2a03134369738a02a58b40
- https://lists.fedoraproject.org/archives/list/[email protected]/message/TZQTSMESZD2RJ5XBPSXH3TIQVUW5DIUU
- https://security.netapp.com/advisory/ntap-20240419-0008
- https://www.enterprisedb.com/docs/jdbc_connector/latest/01_jdbc_rel_notes
- https://www.enterprisedb.com/docs/security/assessments/cve-2024-1597
- https://lists.debian.org/debian-lts-announce/2024/05/msg00007.html
- https://github.com/advisories/GHSA-xfg6-62px-cxc2
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology