Headline
GHSA-7jwh-3vrq-q3m8: pgproto3 SQL Injection via Protocol Message Size Overflow
Impact
SQL injection can occur if an attacker can cause a single query or bind message to exceed 4 GB in size. An integer overflow in the calculated message size can cause the one large message to be sent as multiple messages under the attacker’s control.
Patches
The problem is resolved in v2.3.3
Workarounds
Reject user input large enough to cause a single query or bind message to exceed 4 GB in size.
- GitHub Advisory Database
- GitHub Reviewed
- GHSA-7jwh-3vrq-q3m8
pgproto3 SQL Injection via Protocol Message Size Overflow
Moderate severity GitHub Reviewed Published Mar 4, 2024 in jackc/pgproto3 • Updated Mar 4, 2024
Package
gomod github.com/jackc/pgproto3 (Go)
Affected versions
< 2.3.3
Impact
SQL injection can occur if an attacker can cause a single query or bind message to exceed 4 GB in size. An integer overflow in the calculated message size can cause the one large message to be sent as multiple messages under the attacker’s control.
Patches
The problem is resolved in v2.3.3
Workarounds
Reject user input large enough to cause a single query or bind message to exceed 4 GB in size.
References
- GHSA-7jwh-3vrq-q3m8
- https://nvd.nist.gov/vuln/detail/CVE-2024-27304
- jackc/pgproto3@945c212
Published to the GitHub Advisory Database
Mar 4, 2024