Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

PostgreSQL JDBC driver can allow SQL injection in simple mode

CVE-2024-1597 · published 2 years ago
Summary

The PostgreSQL JDBC driver (used to connect Java applications to PostgreSQL databases) can be tricked into running unwanted SQL commands when it is set to the simple query mode. This could let an attacker change or view data that should be protected. Upgrade to a version released after the listed older releases to eliminate the risk.

What to do
  • Update postgresql org.postgresql:postgresql to version 42.2.28.
  • Update postgresql org.postgresql:postgresql to version 42.3.9.
  • Update postgresql org.postgresql:postgresql to version 42.4.4.
  • Update postgresql org.postgresql:postgresql to version 42.5.5.
  • Update postgresql org.postgresql:postgresql to version 42.6.1.
  • Update postgresql org.postgresql:postgresql to version 42.7.2.
  • Update postgresql org.postgresql:postgresql to version 42.6.0-aikido.3.
  • Update root io.root.org.postgresql:postgresql to version 42.6.0-root.io.3.
  • Update postgresql-jdbc-driver to version 42.7.2.
  • Update debian libpgjava to version 42.5.5-0+deb12u1.
  • Update debian libpgjava to version 42.7.2-1.
  • Update org.postgresql:postgresql to version 42.5.1-aikido.1.
  • Update io.root.org.postgresql:postgresql to version 42.5.1-root.io.1.
Affected software
Ecosystem VendorProductAffected versions
maven postgresql org.postgresql:postgresql < 42.2.28
>= 42.3.0, < 42.3.9
>= 42.4.0, < 42.4.4
>= 42.5.0, < 42.5.5
>= 42.6.0, < 42.6.1
>= 42.7.0, < 42.7.2
Fix: upgrade to 42.2.28
– postgresql postgresql_jdbc_driver < 42.2.28
>= 42.3.0, < 42.3.9
>= 42.4.0, < 42.4.4
>= 42.5.0, < 42.5.5
>= 42.6.0, < 42.6.1
>= 42.7.0, < 42.7.2
cpe:2.3:a:postgresql:postgresql_jdbc_driver:*:*:*:*:*:*:*:*
– fedoraproject fedora 40
cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*
Root:Maven postgresql org.postgresql:postgresql < 42.6.0-aikido.3
Fix: upgrade to 42.6.0-aikido.3
Root:Maven root io.root.org.postgresql:postgresql < 42.6.0-root.io.3
Fix: upgrade to 42.6.0-root.io.3
Bitnami – postgresql-jdbc-driver >= 42.7.0, < 42.7.2
Fix: upgrade to 42.7.2
Debian:12 debian libpgjava < 42.5.5-0+deb12u1
Fix: upgrade to 42.5.5-0+deb12u1
Debian:13 debian libpgjava < 42.7.2-1
Fix: upgrade to 42.7.2-1
Root:Maven – org.postgresql:postgresql < 42.5.1-aikido.1
Fix: upgrade to 42.5.1-aikido.1
Root:Maven – io.root.org.postgresql:postgresql < 42.5.1-root.io.1
Fix: upgrade to 42.5.1-root.io.1
Original advisory text
CVE-2024-1597 in org.postgresql:postgresql - Patched by Root
pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE. Note this is not the default. In the default mode there is no vulnerability. A placeholder for a numeric value must be immediately preceded by a minus. There must be a second placeholder for a string value after the first placeholder; both must be on the same line. By constructing a matching string payload, the attacker can inject SQL to alter the query,bypassing the protections that parameterized queries bring against SQL Injection attacks. Versions before 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9, and 42.2.28 are affected.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
5% chance of attack within 30 days
Type
CWE-89SQL Injection
Timeline
Published19 Feb 2024
Updated7 Oct 2026
First seen6 Mar 2026
Sources
GHSA-24rp-q3w6-vc56 · GHSA
CVE-2024-1597 · NVD
CVE-2024-1597 · OSV
ROOT-APP-MAVEN-CVE-2024-1597 · OSV
BIT-postgresql-jdbc-driver-2024-1597 · OSV
DEBIAN-CVE-2024-1597 · OSV
Track software like this
Free during beta