critical9.8
CVE-2024-27304
pgx SQL Injection via Protocol Message Size Overflow
Impact
### Impact SQL injection can occur if an attacker can cause a single query or bind message to exceed 4 GB in size. An integer overflow in the calculated message size can cause the one large message to be sent as multiple messages under the attacker's control. ### Patches The problem is resolved in v4.18.2 and v5.5.4. ### Workarounds Reject user input large enough to cause a single query or bind message to exceed 4 GB in size.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/jackc/pgx | < 4.18.2 | 4.18.2 |
| go | github.com/jackc/pgx/v4 | < 4.18.2 | 4.18.2 |
| go | github.com/jackc/pgx/v5 | >= 5.0.0, < 5.5.4 | 5.5.4 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Jackc | Pgproto3 | before 2.3.3 |
| Jackc | Pgx | before 4.18.2 from 5.0.0 before 5.5.4 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/jackc/pgproto3/commit/945c2126f6db8f3bea7eeebe307c01fe92bca007
- https://github.com/jackc/pgproto3/security/advisories/GHSA-7jwh-3vrq-q3m8
- https://github.com/jackc/pgx/commit/adbb38f298c76e283ffc7c7a3f571036fea47fd4
- https://github.com/jackc/pgx/commit/c543134753a0c5d22881c12404025724cb05ffd8
- https://github.com/jackc/pgx/commit/f94eb0e2f96782042c96801b5ac448f44f0a81df
- https://github.com/jackc/pgx/security/advisories/GHSA-mrww-27vc-gghv
- https://www.youtube.com/watch?v=Tfg1B8u1yvE
- https://github.com/advisories/GHSA-mrww-27vc-gghv
- https://nvd.nist.gov/vuln/detail/CVE-2024-27304