Headline
GHSA-mrww-27vc-gghv: pgx SQL Injection via Protocol Message Size Overflow
Impact
SQL injection can occur if an attacker can cause a single query or bind message to exceed 4 GB in size. An integer overflow in the calculated message size can cause the one large message to be sent as multiple messages under the attacker’s control.
Patches
The problem is resolved in v4.18.2 and v5.5.4.
Workarounds
Reject user input large enough to cause a single query or bind message to exceed 4 GB in size.
Skip to content
Actions
Automate any workflow
Packages
Host and manage packages
Security
Find and fix vulnerabilities
Codespaces
Instant dev environments
Copilot
Write better code with AI
Code review
Manage code changes
Issues
Plan and track work
Discussions
Collaborate outside of code
GitHub Sponsors
Fund open source developers
* The ReadME Project
GitHub community articles
- Pricing
Provide feedback
Saved searches****Use saved searches to filter your results more quickly
Sign up
- GitHub Advisory Database
- GitHub Reviewed
- CVE-2024-27304
pgx SQL Injection via Protocol Message Size Overflow
Moderate severity GitHub Reviewed Published Mar 4, 2024 in jackc/pgx • Updated Mar 4, 2024
Package
gomod github.com/jackc/pgproto3 (Go)
Affected versions
< 2.3.3
gomod github.com/jackc/pgx (Go)
< 4.18.2
>= 5.0.0, < 5.5.4
Description
Published to the GitHub Advisory Database
Mar 4, 2024
Related news
Red Hat Security Advisory 2024-1321-03 - Updated images are now available for Red Hat Advanced Cluster Security. The updated image includes bug and security fixes. Issues addressed include a remote SQL injection vulnerability.