CVE - CVE-2024-27304

CVE-ID
CVE-2024-27304	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
pgx is a PostgreSQL driver and toolkit for Go. SQL injection can occur if an attacker can cause a single query or bind message to exceed 4 GB in size. An integer overflow in the calculated message size can cause the one large message to be sent as multiple messages under the attacker's control. The problem is resolved in v4.18.2 and v5.5.4. As a workaround, reject user input large enough to cause a single query or bind message to exceed 4 GB in size.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:https://github.com/jackc/pgproto3/commit/945c2126f6db8f3bea7eeebe307c01fe92bca007 URL:https://github.com/jackc/pgproto3/commit/945c2126f6db8f3bea7eeebe307c01fe92bca007 MISC:https://github.com/jackc/pgproto3/security/advisories/GHSA-7jwh-3vrq-q3m8 URL:https://github.com/jackc/pgproto3/security/advisories/GHSA-7jwh-3vrq-q3m8 MISC:https://github.com/jackc/pgx/commit/adbb38f298c76e283ffc7c7a3f571036fea47fd4 URL:https://github.com/jackc/pgx/commit/adbb38f298c76e283ffc7c7a3f571036fea47fd4 MISC:https://github.com/jackc/pgx/commit/c543134753a0c5d22881c12404025724cb05ffd8 URL:https://github.com/jackc/pgx/commit/c543134753a0c5d22881c12404025724cb05ffd8 MISC:https://github.com/jackc/pgx/commit/f94eb0e2f96782042c96801b5ac448f44f0a81df URL:https://github.com/jackc/pgx/commit/f94eb0e2f96782042c96801b5ac448f44f0a81df MISC:https://github.com/jackc/pgx/security/advisories/GHSA-mrww-27vc-gghv URL:https://github.com/jackc/pgx/security/advisories/GHSA-mrww-27vc-gghv
Assigning CNA
GitHub (maintainer security advisories)
Date Record Created
20240222	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20240222)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)