Postgres version vulnerability
Issue date: 02-10-2024Affects versions: 15.6, 15.5, 15.4, 15.2, 15.1
Security Issue ID
SECURITY-546
Affected Product Version(s)
15.6.0, 14.7.20 (and previous patch releases)
Severity
High
Description
pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE. Note this is not the default. In the default mode there is no vulnerability. A placeholder for a numeric value must be immediately preceded by a minus. There must be a second placeholder for a string value after the first placeholder; both must be on the same line. By constructing a matching string payload, the attacker can inject SQL to alter the query,bypassing the protections that parameterized queries bring against SQL Injection attacks.
CVSS v3 Base Score: 10.0
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Instructions
Customers are recommended to upgrade to the latest version. As of the time of writing, 14.7.21, 15.7.0.