SQL Injection Affecting org.postgresql:postgresql package, versions [,42.2.28.jre7) [42.3.0,42.3.9) [42.4.0,42.4.4) [42.5.0,42.5.5) [42.6.0,42.6.1) [42.7.0,42.7.2)
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-ORGPOSTGRESQL-6252740
- published 19 Feb 2024
- disclosed 19 Feb 2024
- credit Unknown
Introduced: 19 Feb 2024
CVE-2024-1597 Open this link in a new tabHow to fix?
Upgrade org.postgresql:postgresql to version 42.2.28.jre7, 42.3.9, 42.4.4, 42.5.5, 42.6.1, 42.7.2 or higher.
Overview
org.postgresql:postgresql is a Java JDBC 4.2 (JRE 8+) driver for PostgreSQL database.
Affected versions of this package are vulnerable to SQL Injection when using PreferQueryMode=SIMPLE, which is not the default setting. By passing in a numeric value placeholder immediately preceded by a minus and followed by a second placeholder for a string value, on the same line, an attacker can construct a payload that alters the parameterized query into which it is interpolated. This effectively bypasses the protections against SQL Injection that parameterized queries offer.