Security
Headlines
HeadlinesLatestCVEs

Headline

GHSA-7jwh-3vrq-q3m8: pgproto3 SQL Injection via Protocol Message Size Overflow

Impact

SQL injection can occur if an attacker can cause a single query or bind message to exceed 4 GB in size. An integer overflow in the calculated message size can cause the one large message to be sent as multiple messages under the attacker’s control.

Patches

The problem is resolved in v2.3.3

Workarounds

Reject user input large enough to cause a single query or bind message to exceed 4 GB in size.

ghsa
#sql#git
  1. GitHub Advisory Database
  2. GitHub Reviewed
  3. GHSA-7jwh-3vrq-q3m8

pgproto3 SQL Injection via Protocol Message Size Overflow

Moderate severity GitHub Reviewed Published Mar 4, 2024 in jackc/pgproto3 • Updated Mar 4, 2024

Package

gomod github.com/jackc/pgproto3 (Go)

Affected versions

< 2.3.3

Impact

SQL injection can occur if an attacker can cause a single query or bind message to exceed 4 GB in size. An integer overflow in the calculated message size can cause the one large message to be sent as multiple messages under the attacker’s control.

Patches

The problem is resolved in v2.3.3

Workarounds

Reject user input large enough to cause a single query or bind message to exceed 4 GB in size.

References

  • GHSA-7jwh-3vrq-q3m8
  • https://nvd.nist.gov/vuln/detail/CVE-2024-27304
  • jackc/pgproto3@945c212

Published to the GitHub Advisory Database

Mar 4, 2024

ghsa: Latest News

GHSA-486g-47cc-8wxf: aiocpa contains credential harvesting code