GO-2024-2605
SQL injection in github.com/jackc/pgx/v4
At a glance
- Published
- Updated
- CVE
- CVE-2024-27289
- Aliases
- GHSA-m7wr-2xf7-cm9p
Description
SQL injection is possible when the database uses the non-default simple protocol, a minus sign directly precedes a numeric placeholder followed by a string placeholder on the same line, and both parameter values are user-controlled.
Affected packages
| Package | Versions |
|---|---|
| Go · github.com/jackc/pgx | introduced 0 |
| Go · github.com/jackc/pgx/v4 | introduced 0, fixed 4.18.2 |
References
- https://github.com/jackc/pgx/security/advisories/GHSA-m7wr-2xf7-cm9p ADVISORY
- https://github.com/jackc/pgx/commit/f94eb0e2f96782042c96801b5ac448f44f0a81df FIX
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — Go Vulnerability Database |