CVE-2024-27304: pgx SQL Injection via Protocol Message Size Overflow
(updated )
SQL injection can occur if an attacker can cause a single query or bind message to exceed 4 GB in size. An integer overflow in the calculated message size can cause the one large message to be sent as multiple messages under the attacker’s control.
References
- github.com/advisories/GHSA-mrww-27vc-gghv
- github.com/jackc/pgproto3/commit/945c2126f6db8f3bea7eeebe307c01fe92bca007
- github.com/jackc/pgproto3/security/advisories/GHSA-7jwh-3vrq-q3m8
- github.com/jackc/pgx
- github.com/jackc/pgx/commit/adbb38f298c76e283ffc7c7a3f571036fea47fd4
- github.com/jackc/pgx/commit/c543134753a0c5d22881c12404025724cb05ffd8
- github.com/jackc/pgx/commit/f94eb0e2f96782042c96801b5ac448f44f0a81df
- github.com/jackc/pgx/security/advisories/GHSA-mrww-27vc-gghv
- nvd.nist.gov/vuln/detail/CVE-2024-27304
- www.youtube.com/watch?v=Tfg1B8u1yvE
Detect and mitigate CVE-2024-27304 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →