SQL injection in PostgreSQL driver and toolkit for Go - CVE-2024-27289

 

SQL injection in PostgreSQL driver and toolkit for Go - CVE-2024-27289

Published: March 26, 2024


Vulnerability identifier: #VU87833
CSH Severity: Medium
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-27289
CWE-ID: CWE-89
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.

The vulnerability exists due to insufficient sanitization of user-supplied data under certain conditions. A remote attacker can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.

Successful exploitation of this vulnerability requires that all of the following conditions are met: the non-default simple protocol is used; a placeholder for a numeric value must be immediately preceded by a minus; there must be a second placeholder for a string value after the first placeholder; both must be on the same line; and both parameter values must be user-controlled.


Affected software

PostgreSQL driver and toolkit for Go
Agent
DB2 Data Management Console
Red Hat Advanced Cluster Security for Kubernetes
Fedora
QRadar Suite
caddy
Red Hat OpenShift Container Platform

How to mitigate CVE-2024-27289

Install update from vendor's website.

PostgreSQL driver and toolkit for Go - update to 4.18.2
Agent - update to 0.40.4
DB2 Data Management Console - update to 3.1.13
Red Hat Advanced Cluster Security for Kubernetes - update to 4.3.5
QRadar Suite - update to 1.10.22.0
caddy - update to 2.8.4-1.fc41
Red Hat OpenShift Container Platform - addressed in versions 4.16.17, 4.17.1

External References

Related Security Bulletins