Homepage

Uncaught Exception Affecting github.com/jackc/pgx/v5/pgconn package, versions >=5.0.0-alpha.5 <5.5.2

Severity

 Recommended
0.0
high
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Uncaught Exception vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-GOLANG-GITHUBCOMJACKCPGXV5PGCONN-7416899
  • published3 Jul 2024
  • disclosed2 Jul 2024
  • creditUnknown
Report a new vulnerability Found a mistake?

Introduced: 2 Jul 2024

CVE NOT AVAILABLE CWE-248  (opens in a new tab)

How to fix?

Upgrade github.com/jackc/pgx/v5/pgconn to version 5.5.2 or higher.

Overview

github.com/jackc/pgx/v5/pgconn is a low-level PostgreSQL database driver

Affected versions of this package are vulnerable to Uncaught Exception that allows creating a pipeline in error with a PgConn that is busy or closed. This allows an attacker who can ascertain that a pipeline is in such a state to trigger a panic by calling the Sync() function on the pipeline.

CVSS Scores

version 4.0
version 3.1