SQL injection in PostgreSQL driver and toolkit for Go - CVE-2024-27289
Published: March 26, 2024
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.
The vulnerability exists due to insufficient sanitization of user-supplied data under certain conditions. A remote attacker can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.
Successful exploitation of this vulnerability requires that all of the following conditions are met: the non-default simple protocol is used; a placeholder for a numeric value must be immediately preceded by a minus; there must be a second placeholder for a string value after the first placeholder; both must be on the same line; and both parameter values must be user-controlled.
Affected software
Agent
DB2 Data Management Console
Red Hat Advanced Cluster Security for Kubernetes
Fedora
QRadar Suite
caddy
Red Hat OpenShift Container Platform
How to mitigate CVE-2024-27289
Agent - update to 0.40.4
DB2 Data Management Console - update to 3.1.13
Red Hat Advanced Cluster Security for Kubernetes - update to 4.3.5
QRadar Suite - update to 1.10.22.0
caddy - update to 2.8.4-1.fc41
Red Hat OpenShift Container Platform - addressed in versions 4.16.17, 4.17.1
External References
Related Security Bulletins
- Multiple vulnerabilities in PostgreSQL driver and toolkit for Go
- Multiple vulnerabilities in Red Hat Advanced Cluster Security for Kubernetes 4.3
- Multiple vulnerabilities in Agent
- Fedora 41 update for caddy
- Multiple vulnerabilities in IBM QRadar Suite Software
- Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.17
- SQL injection in Red Hat OpenShift Container Platform 4.16
- IBM DB2 Data Management Console update for jackc pgx