GitHub Advisoryadvisory · Go
GHSA-7jwh-3vrq-q3m8 pgproto3 SQL Injection via Protocol Message Size Overflow
HIGH
Official page ↗
- Ecosystem
- Go
- Packages
- github.com/jackc/pgproto3, github.com/jackc/pgproto3/v2
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-190, CWE-89
- Reviewed
- 2024-03-04
Affected packages
• Go github.com/jackc/pgproto3: < 2.3.3 → fixed in 2.3.3
• Go github.com/jackc/pgproto3/v2: < 2.3.3 → fixed in 2.3.3
Description
Impact
SQL injection can occur if an attacker can cause a single query or bind message to exceed 4 GB in size. An integer overflow in the calculated message size can cause the one large message to be sent as multiple messages under the attacker's control.
Patches
The problem is resolved in v2.3.3
Workarounds
Reject user input large enough to cause a single query or bind message to exceed 4 GB in size.
Related
References
- https://github.com/jackc/pgproto3/security/advisories/GHSA-7jwh-3vrq-q3m8 web
- https://github.com/jackc/pgx/security/advisories/GHSA-mrww-27vc-gghv web
- https://nvd.nist.gov/vuln/detail/CVE-2024-27304 advisory
- https://github.com/jackc/pgproto3/commit/945c2126f6db8f3bea7eeebe307c01fe92bca007 web
- https://github.com/jackc/pgx/commit/adbb38f298c76e283ffc7c7a3f571036fea47fd4 web
- https://github.com/jackc/pgx/commit/c543134753a0c5d22881c12404025724cb05ffd8 web
- https://github.com/jackc/pgx/commit/f94eb0e2f96782042c96801b5ac448f44f0a81df web
- https://github.com/jackc/pgproto3 package