Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
Outdated PostgreSQL JDBC Driver Exposes Sensitive Data
published 2 years ago
Summary
The PostgreSQL JDBC driver for Java may leak sensitive data, such as database credentials, due to an outdated version. This could happen when the driver is used in applications that don't properly handle connection pooling. To protect against this risk, update the PostgreSQL JDBC driver to the latest version.
What to do
- Update redhat postgresql-jdbc to version 0:42.2.28-1.el9_2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Red Hat:rhel_eus:9.2::appstream | redhat | postgresql-jdbc |
< 0:42.2.28-1.el9_2 Fix: upgrade to 0:42.2.28-1.el9_2
|
Original advisory text
Red Hat Security Advisory: postgresql-jdbc: security update
References
- https://access.redhat.com/errata/RHSA-2024:1649 Vendor Advisory
- https://access.redhat.com/security/updates/classification/#important Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2266523 Third Party Advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1649.j... Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2024-1597 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2024-1597 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-1597 Vendor Advisory
- https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-24rp-q3w6-vc56 Third Party Advisory
- https://www.enterprisedb.com/docs/jdbc_connector/latest/01_jdbc_rel_notes/ Third Party Advisory
- https://www.enterprisedb.com/docs/security/assessments/cve-2024-1597/ Third Party Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Timeline
Published18 Sep 2024
Updated30 Apr 2026
First seen30 Apr 2026
Sources
RHSA-2024:1649 · OSV
Track software like this
Free during beta