[{"vendor":"pgjdbc","product":"pgjdbc","defaultStatus":"unknown","cpes":["cpe:2.3:a:pgjdbc:pgjdbc:*:*:*:*:*:*:*:*"],"versions":[{"version":"0","lessThan":"42.7.2","versionType":"custom","status":"affected"},{"version":"0","lessThan":"42.6.1","versionType":"custom","status":"affected"},{"version":"0","lessThan":"42.5.5","versionType":"custom","status":"affected"},{"version":"0","lessThan":"42.4.4","versionType":"custom","status":"affected"},{"version":"0","lessThan":"42.3.9","versionType":"custom","status":"affected"},{"version":"0","lessThan":"42.2.28","versionType":"custom","status":"affected"}]}]

{"timestamp":"2024-04-10T04:00:36.120593Z","id":"CVE-2024-1597","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}

[{"vendor":"pgjdbc","product":"pgjdbc","versions":[{"version":"< 42.7.2","status":"affected"},{"version":"< 42.6.1","status":"affected"},{"version":"< 42.5.5","status":"affected"},{"version":"< 42.4.4","status":"affected"},{"version":"< 42.3.9","status":"affected"},{"version":"< 42.2.28","status":"affected"}]}]

https://lists.debian.org/debian-lts-announce/2024/12/msg00017.html

https://www.sonarsource.com/blog/double-dash-double-trouble-a-subtle-sql-injection-flaw/

http://www.openwall.com/lists/oss-security/2024/04/02/6

https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-24rp-q3w6-vc56

https://lists.debian.org/debian-lts-announce/2024/05/msg00007.html

https://lists.fedoraproject.org/archives/list/[email protected]/message/TZQTSMESZD2RJ5XBPSXH3TIQVUW5DIUU/

https://security.netapp.com/advisory/ntap-20240419-0008/

https://www.enterprisedb.com/docs/jdbc_connector/latest/01_jdbc_rel_notes/

https://www.enterprisedb.com/docs/security/assessments/cve-2024-1597/

PostgreSQL https://lists.debian.org/debian-lts-announce/2024/05/msg00007.html [No types assigned]

PostgreSQL http://www.openwall.com/lists/oss-security/2024/04/02/6 [No types assigned]

PostgreSQL https://security.netapp.com/advisory/ntap-20240419-0008/ [No types assigned]

pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE. Note this is not the default. In the default mode there is no vulnerability. A placeholder for a numeric value must be immediately preceded by a minus. There must be a second placeholder for a string value after the first placeholder; both must be on the same line. By constructing a matching string payload, the attacker can inject SQL to alter the query,bypassing the protections that parameterized queries bring against SQL Injection attacks. Versions before 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9, and 42.2.8 are affected.

pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE. Note this is not the default. In the default mode there is no vulnerability. A placeholder for a numeric value must be immediately preceded by a minus. There must be a second placeholder for a string value after the first placeholder; both must be on the same line. By constructing a matching string payload, the attacker can inject SQL to alter the query,bypassing the protections that parameterized queries bring against SQL Injection attacks. Versions before 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9, and 42.2.28 are affected.

NIST AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NIST CWE-89

OR
 *cpe:2.3:a:postgresql:postgresql_jdbc_driver:*:*:*:*:*:*:*:* versions up to (excluding) 42.2.28
 *cpe:2.3:a:postgresql:postgresql_jdbc_driver:*:*:*:*:*:*:*:* versions from (including) 42.3.0 up to (excluding) 42.3.9
 *cpe:2.3:a:postgresql:postgresql_jdbc_driver:*:*:*:*:*:*:*:* versions from (including) 42.4.0 up to (excluding) 42.4.4
 *cpe:2.3:a:postgresql:postgresql_jdbc_driver:*:*:*:*:*:*:*:* versions from (including) 42.5.0 up to (excluding) 42.5.5
 *cpe:2.3:a:postgresql:postgresql_jdbc_driver:*:*:*:*:*:*:*:* versions from (including) 42.6.0 up to (excluding) 42.6.1
 *cpe:2.3:a:postgresql:postgresql_jdbc_driver:*:*:*:*:*:*:*:* versions from (including) 42.7.0 up to (excluding) 42.7.2

OR
 *cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*

https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-24rp-q3w6-vc56 No Types Assigned

https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-24rp-q3w6-vc56 Third Party Advisory

https://lists.fedoraproject.org/archives/list/[email protected]/message/TZQTSMESZD2RJ5XBPSXH3TIQVUW5DIUU/ No Types Assigned

https://lists.fedoraproject.org/archives/list/[email protected]/message/TZQTSMESZD2RJ5XBPSXH3TIQVUW5DIUU/ Mailing List, Third Party Advisory

https://www.enterprisedb.com/docs/jdbc_connector/latest/01_jdbc_rel_notes/ No Types Assigned

https://www.enterprisedb.com/docs/jdbc_connector/latest/01_jdbc_rel_notes/ Release Notes

https://www.enterprisedb.com/docs/security/assessments/cve-2024-1597/ No Types Assigned

https://www.enterprisedb.com/docs/security/assessments/cve-2024-1597/ Third Party Advisory

PostgreSQL https://lists.fedoraproject.org/archives/list/[email protected]/message/TZQTSMESZD2RJ5XBPSXH3TIQVUW5DIUU/ [No types assigned]

PostgreSQL https://www.enterprisedb.com/docs/jdbc_connector/latest/01_jdbc_rel_notes/ [No types assigned]

PostgreSQL https://www.enterprisedb.com/docs/security/assessments/cve-2024-1597/ [No types assigned]

pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE. Note this is not the default. In the default mode there is no vulnerability. A placeholder for a numeric value must be immediately preceded by a minus. There must be a second placeholder for a string value after the first placeholder; both must be on the same line. By constructing a matching string payload, the attacker can inject SQL to alter the query,bypassing the protections that parameterized queries bring against SQL Injection attacks. Versions before 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9, and 42.2.8 are affected.

PostgreSQL AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

PostgreSQL CWE-89

PostgreSQL https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-24rp-q3w6-vc56 [No types assigned]