CVE-2024-1597 json
pgjdbc SQL Injection via line comment generation
published 2024-02-19 2 y ago modified 2026-09-10 59 d ago also BIT-postgresql-jdbc-driver-2024-1597 , EUVD-2024-0465 , GHSA-24rp-q3w6-vc56
- cvss
- 10.0
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 4.8%
- EPSS 4.8% chance of exploitation in 30 days, percentile 92%
- public exploits
- 0
- none known
Summary
pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE. Note this is not the default. In the default mode there is no vulnerability. A placeholder for a numeric value must be immediately preceded by a minus. There must be a second placeholder for a string value after the first placeholder; both must be on the same line. By constructing a matching string payload, the attacker can inject SQL to alter the query,bypassing the protections that parameterized queries bring against SQL Injection attacks. Versions before 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9, and 42.2.28 are affected.
Patch / fix
- maven org.postgresql:postgresql 42.2.28, 42.3.9, 42.4.4, 42.5.5, 42.6.1, 42.7.2
- bitnami postgresql-jdbc-driver 42.2.28, 42.3.9, 42.4.4, 42.5.5, 42.6.1, 42.7.2
- pgjdbc pgjdbc 42.2.28, 42.3.9, 42.4.4, 42.5.5, 42.6.1, 42.7.2
- libpgjava Debian 12 42.5.5-0+deb12u1
- libpgjava Debian 14, Debian 13 42.7.2-1
debian advisories DEBIAN-CVE-2024-1597
- postgresql-jdbc RHEL 9 42.2.28-1.el9_3
- postgresql-jdbc RHEL 8 42.2.14-3.el8_9
- postgresql-jdbc-javadoc RHEL 8 42.2.14-3.el8_9
- postgresql-jdbc RHEL 8.6 TUS, RHEL 8.6 E4S, RHEL 8.6 AUS 42.2.3-5.el8_6
- postgresql-jdbc-javadoc RHEL 8.6 TUS, RHEL 8.6 E4S, RHEL 8.6 AUS 42.2.3-5.el8_6
- postgresql-jdbc RHEL 8.4 TUS, RHEL 8.4 E4S, RHEL 8.4 AUS 42.2.3-7.el8_4
- postgresql-jdbc-javadoc RHEL 8.4 TUS, RHEL 8.4 E4S, RHEL 8.4 AUS 42.2.3-7.el8_4
- postgresql-jdbc RHEL 8.8 EUS 42.2.14-5.el8_8
red hat advisories RHSA-2024:4402RHSA-2024:4375RHSA-2024:3313RHSA-2024:1999RHSA-2024:2624RHSA-2024:1649
- postgresql-jdbc SLES for SAP 15 SP4, SLES 15 SP4-LTSS, SLE Module for Server Applications 15 SP5 +5 more 42.2.25-150400.3.12.1
- postgresql-jdbc SLES for SAP 12 SP5, SLES 12 SP5 9.4-3.12.1
- postgresql-jdbc SLES for SAP 15 SP3, SLES 15 SP3-LTSS, SLE High Performance Computing 15 SP3-LTSS +1 more 42.2.25-150300.3.14.1
suse advisories SUSE-SU-2024:0773-1SUSE-SU-2024:0771-1SUSE-SU-2024:0769-1
- postgresql-jdbc AlmaLinux 8 42.2.14-3.el8_9
- postgresql-jdbc-javadoc AlmaLinux 8 42.2.14-3.el8_9
- postgresql-jdbc AlmaLinux 9 42.2.28-1.el9_3
almalinux advisories ALSA-2024:1435ALSA-2024:1436
- postgresql-jdbc Rocky Linux 9 42.2.28-1.el9_3
- postgresql-jdbc Rocky Linux 8 42.2.14-3.el8_9
rocky linux advisories RLSA-2024:1436RLSA-2024:1435
- java-postgresql-jdbc Alpine 3.24, Alpine 3.23, Alpine 3.22 +3 more 42.6.2-r0
alpine advisories ALPINE-CVE-2024-1597
Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2024-1597 updated cvss 9.8
pgjdbc: PostgreSQL JDBC Driver allows attacker to inject SQL if using PreferQueryMode=SIMPLE
-
Red Hat build of Apache Camel 4 for Quarkus 3 pgjdbcaffected: workaround, no fix planned “Do not use the connection propertypreferQueryMode=simple. If you do not explicitly specify a query mode, then you are using the default of extended and are not impacted by this issue.”
-
Red Hat build of Apache Camel for Spring Boot 3 pgjdbcaffected: workaround, no fix available “Do not use the connection propertypreferQueryMode=simple. If you do not explicitly specify a query mode, then you are using the default of extended and are not impacted by this issue.”
-
Red Hat build of OptaPlanner 8 pgjdbc Red Hat Enterprise Linux 8 postgresql-jdbc, postgresql-jdbc-javadoc Red Hat Enterprise Linux 9 postgresql-jdbc Red Hat Integration Camel Quarkus 2 pgjdbc Red Hat Process Automation 7 pgjdbcaffected: workaround, no fix planned “Do not use the connection propertypreferQueryMode=simple. If you do not explicitly specify a query mode, then you are using the default of extended and are not impacted by this issue.”
-
Red Hat Middleware Containers for OpenShift rh-sso-7/sso76-openshift-rhel8 7.6-42, rh-sso-7/sso7-rhel8-operator-bundle 7.6.7-4fixed: vendor fix “Do not use the connection propertypreferQueryMode=simple. If you do not explicitly specify a query mode, then you are using the default of extended and are not impacted by this issue.” RHSA-2024:1686
-
Red Hat build of Apache Camel 4.4.1 for Spring Boot 3.2fixed: vendor fix “Do not use the connection propertypreferQueryMode=simple. If you do not explicitly specify a query mode, then you are using the default of extended and are not impacted by this issue.” RHSA-2024:4884
-
Red Hat build of Keycloak 24fixed: vendor fix “Do not use the connection propertypreferQueryMode=simple. If you do not explicitly specify a query mode, then you are using the default of extended and are not impacted by this issue.” RHBA-2024:2108
-
Red Hat build of Quarkus 2.13.9.SP2 postgresql 42.5.6.redhat-00001fixed: vendor fix “Do not use the connection propertypreferQueryMode=simple. If you do not explicitly specify a query mode, then you are using the default of extended and are not impacted by this issue.” RHSA-2024:1797
-
Red Hat build of Quarkus 3.2.11.Final postgresql 42.6.1.redhat-00001fixed: vendor fix “Do not use the connection propertypreferQueryMode=simple. If you do not explicitly specify a query mode, then you are using the default of extended and are not impacted by this issue.” RHSA-2024:1662
show 17 moreshow fewer
-
Red Hat Enterprise Linux AppStream (v. 8) postgresql-jdbc 42.2.14-3.el8_9, postgresql-jdbc-javadoc 42.2.14-3.el8_9fixed: vendor fix “Do not use the connection propertypreferQueryMode=simple. If you do not explicitly specify a query mode, then you are using the default of extended and are not impacted by this issue.” RHSA-2024:1435
-
Red Hat Enterprise Linux AppStream (v. 9) postgresql-jdbc 42.2.28-1.el9_3fixed: vendor fix “Do not use the connection propertypreferQueryMode=simple. If you do not explicitly specify a query mode, then you are using the default of extended and are not impacted by this issue.” RHSA-2024:1436
-
Red Hat Enterprise Linux AppStream AUS (v. 8.2) postgresql-jdbc 42.2.3-5.el8_2, postgresql-jdbc-javadoc 42.2.3-5.el8_2fixed: vendor fix “Do not use the connection propertypreferQueryMode=simple. If you do not explicitly specify a query mode, then you are using the default of extended and are not impacted by this issue.” RHSA-2024:2624
-
Red Hat Enterprise Linux AppStream AUS (v.8.4) postgresql-jdbc 42.2.3-7.el8_4, postgresql-jdbc-javadoc 42.2.3-7.el8_4fixed: vendor fix “Do not use the connection propertypreferQueryMode=simple. If you do not explicitly specify a query mode, then you are using the default of extended and are not impacted by this issue.” RHSA-2024:4375
-
Red Hat Enterprise Linux AppStream AUS (v.8.6) postgresql-jdbc 42.2.3-5.el8_6, postgresql-jdbc-javadoc 42.2.3-5.el8_6fixed: vendor fix “Do not use the connection propertypreferQueryMode=simple. If you do not explicitly specify a query mode, then you are using the default of extended and are not impacted by this issue.” RHSA-2024:4402
-
Red Hat Enterprise Linux AppStream E4S (v. 8.2) postgresql-jdbc 42.2.3-5.el8_2, postgresql-jdbc-javadoc 42.2.3-5.el8_2fixed: vendor fix “Do not use the connection propertypreferQueryMode=simple. If you do not explicitly specify a query mode, then you are using the default of extended and are not impacted by this issue.” RHSA-2024:2624
-
Red Hat Enterprise Linux AppStream E4S (v.8.4) postgresql-jdbc 42.2.3-7.el8_4, postgresql-jdbc-javadoc 42.2.3-7.el8_4fixed: vendor fix “Do not use the connection propertypreferQueryMode=simple. If you do not explicitly specify a query mode, then you are using the default of extended and are not impacted by this issue.” RHSA-2024:4375
-
Red Hat Enterprise Linux AppStream E4S (v.8.6) postgresql-jdbc 42.2.3-5.el8_6, postgresql-jdbc-javadoc 42.2.3-5.el8_6fixed: vendor fix “Do not use the connection propertypreferQueryMode=simple. If you do not explicitly specify a query mode, then you are using the default of extended and are not impacted by this issue.” RHSA-2024:4402
-
Red Hat Enterprise Linux AppStream EUS (v.8.8) postgresql-jdbc 42.2.14-5.el8_8, postgresql-jdbc-javadoc 42.2.14-5.el8_8fixed: vendor fix “Do not use the connection propertypreferQueryMode=simple. If you do not explicitly specify a query mode, then you are using the default of extended and are not impacted by this issue.” RHSA-2024:3313
-
Red Hat Enterprise Linux AppStream EUS (v.9.0) postgresql-jdbc 42.2.28-1.el9_0fixed: vendor fix “Do not use the connection propertypreferQueryMode=simple. If you do not explicitly specify a query mode, then you are using the default of extended and are not impacted by this issue.” RHSA-2024:1999
-
Red Hat Enterprise Linux AppStream EUS (v.9.2) postgresql-jdbc 42.2.28-1.el9_2fixed: vendor fix “Do not use the connection propertypreferQueryMode=simple. If you do not explicitly specify a query mode, then you are using the default of extended and are not impacted by this issue.” RHSA-2024:1649
-
Red Hat Enterprise Linux AppStream TUS (v. 8.2) postgresql-jdbc 42.2.3-5.el8_2, postgresql-jdbc-javadoc 42.2.3-5.el8_2fixed: vendor fix “Do not use the connection propertypreferQueryMode=simple. If you do not explicitly specify a query mode, then you are using the default of extended and are not impacted by this issue.” RHSA-2024:2624
-
Red Hat Enterprise Linux AppStream TUS (v.8.4) postgresql-jdbc 42.2.3-7.el8_4, postgresql-jdbc-javadoc 42.2.3-7.el8_4fixed: vendor fix “Do not use the connection propertypreferQueryMode=simple. If you do not explicitly specify a query mode, then you are using the default of extended and are not impacted by this issue.” RHSA-2024:4375
-
Red Hat Enterprise Linux AppStream TUS (v.8.6) postgresql-jdbc 42.2.3-5.el8_6, postgresql-jdbc-javadoc 42.2.3-5.el8_6fixed: vendor fix “Do not use the connection propertypreferQueryMode=simple. If you do not explicitly specify a query mode, then you are using the default of extended and are not impacted by this issue.” RHSA-2024:4402
-
Red Hat OpenShift Serverless 1.33 openshift-serverless-1/logic-rhel8-operator 1.33.0-3, openshift-serverless-1/logic-operator-bundle 1.33.0-5, openshift-serverless-1/logic-swf-builder-rhel8 1.33.0-5, openshift-serverless-1/logic-swf-devmode-rhel8 1.33.0-5, openshift-serverless-1/logic-data-index-ephemeral-rhel8 1.33.0-5, openshift-serverless-1/logic-data-index-postgresql-rhel8 1.33.0-5, +3 morefixed: vendor fix “Do not use the connection propertypreferQueryMode=simple. If you do not explicitly specify a query mode, then you are using the default of extended and are not impacted by this issue.” RHSA-2024:4057
-
Red Hat RHINT Camel-K 1.10.7fixed: vendor fix “Do not use the connection propertypreferQueryMode=simple. If you do not explicitly specify a query mode, then you are using the default of extended and are not impacted by this issue.” RHSA-2024:5056
-
Red Hat build of Apicurio Registry 2 pgjdbc Red Hat build of Quarkus 2.13.9.SP2 jna 5.8.0, bson 4.7.2, db2 1.17.3, h2 2.1.214, hppc 0.8.1, jansi 1.18, +986 more Red Hat build of Quarkus 3.2.11.Final jna 5.8.0, lit 2.7.4, bson 4.9.1, db2 1.18.3, h2 2.2.220, jdom 1.1.3, +1046 more Red Hat Enterprise Linux 6 postgresql-jdbc Red Hat Enterprise Linux 7 postgresql-jdbc, postgresql-jdbc-javadoc Red Hat Fuse 7 pgjdbcnot affected: vulnerable code not present
+3 more productsfewer
Red Hat JBoss Enterprise Application Platform 8 org.postgresql-pgjdbc Red Hat Satellite 6 candlepin, candlepin-selinux Red Hat Virtualization 4 postgresql-jdbc, postgresql-jdbc-javadoc
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- total
- Assessed
- 2 y ago
Exploit prediction
4.81% chance of exploitation in the next 30 days, higher than 92% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 10.0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| GitHub | 3.1 | 10.0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| OSV | 3.1 | 10.0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.postgresql:postgresql | <42.2.28 >=42.3.0, <42.3.9 >=42.4.0, <42.4.4 >=42.5.0, <42.5.5 >=42.6.0, <42.6.1 >=42.7.0, <42.7.2 |
42.2.28 42.3.9 42.4.4 42.5.5 42.6.1 42.7.2 |
| bitnami | postgresql-jdbc-driver | <42.2.28 >=42.3.0, <42.3.9 >=42.4.0, <42.4.4 >=42.5.0, <42.5.5 >=42.6.0, <42.6.1 >=42.7.0, <42.7.2 |
42.2.28 42.3.9 42.4.4 42.5.5 42.6.1 42.7.2 |
Affected products
- pgjdbc pgjdbc
Classification
- Weakness
-
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command
References
-
github.com
/pgjdbc/pgjdbc/commit/06abfb78a627277a580d4df825f210e96a4e14ee
web
-
github.com
/pgjdbc/pgjdbc/commit/93b0fcb2711d9c1e3a2a03134369738a02a58b40
web
-
github.com
/pgjdbc/pgjdbc/security/advisories/GHSA-24rp-q3w6-vc56
web, third-party-advisory, advisory
-
enterprisedb.com
/docs/security/assessments/cve-2024-1597/
third-party-advisory, advisory
-
enterprisedb.com
/docs/jdbc_connector/latest/01_jdbc_rel_notes/
release-notes, article
-
lists.fedoraproject.org
/archives/list/package-announce@lists.fedoraproject.org/message/TZQTSMESZD2RJ5XBPSXH3TIQVUW5DIUU/
mailing-list, third-party-advisory, advisory
-
security.netapp.com
/advisory/ntap-20240419-0008/
web
-
openwall.com
/lists/oss-security/2024/04/02/6
web
-
lists.debian.org
/debian-lts-announce/2024/05/msg00007.html
web
-
sonarsource.com
/blog/double-dash-double-trouble-a-subtle-sql-injection-flaw/
web
-
lists.debian.org
/debian-lts-announce/2024/12/msg00017.html
web
-
nvd.nist.gov
/vuln/detail/CVE-2024-1597
advisory, web
-
github.com
/pgjdbc/pgjdbc
package
Sources
- CVE List CVE-2024-1597
- GitHub Advisory GHSA-24rp-q3w6-vc56
- NVD CVE-2024-1597
- OSV BIT-postgresql-jdbc-driver-2024-1597
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.