Security Digest · Vulnerability record
CVE-2024-1597: org.postgresql:postgresql vulnerable to SQL Injection via line comment generation
pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE.
CVSS 10.0 Critical EPSS 4.8% · p92
Should you act?
Critical and remotely reachable
No known exploitation yet, but it is network-reachable without credentials. This signal is computed from CISA KEV, EPSS and CVSS data; it is not an editorial verdict.
- Not in CISA KEV, but CISA’s SSVC assessment records a public proof-of-concept, so attack code exists.
- EPSS 4.8%, percentile 92: FIRST’s model estimates a 4.8% chance of exploitation activity in the next 30 days, higher than 92% of all scored CVEs (elevated). EPSS is a probability, not a verdict.
- Remotely reachable with no login and no user interaction. If the vulnerable service is exposed to the internet, prioritize it.
- Only applies if your dependency tree includes
org.postgresql:postgresql(Maven) < 42.2.28, fixed in 42.2.28;org.postgresql:postgresql(Maven) >= 42.3.0, < 42.3.9, fixed in 42.3.9;org.postgresql:postgresql(Maven) >= 42.4.0, < 42.4.4, fixed in 42.4.4;org.postgresql:postgresql(Maven) >= 42.5.0, < 42.5.5, fixed in 42.5.5. Check your lockfile, including transitive dependencies.
What it is
pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE. Note this is not the default. In the default mode there is no vulnerability. A placeholder for a numeric value must be immediately preceded by a minus. There must be a second placeholder for a string value after the first placeholder; both must be on the same line. By constructing a matching string payload, the attacker can inject SQL to alter the query,bypassing the protections that parameterized queries bring against SQL Injection attacks. Versions before 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9, and 42.2.28 are affected.
From the GitHub advisory
Impact SQL injection is possible when using the non-default connection property preferQueryMode=simple in combination with application code that has a vulnerable SQL that negates a parameter value.
There is no vulnerability in the driver when using the default query mode. Users that do not override the query mode are not impacted.
Exploitation
To exploit this behavior the following conditions must be met:
1. A placeholder for a numeric value must be immediately preceded by a minus (i.e. -) 1. There must be a second placeholder for a string value after the first placeholder on the same line. 1. Both parameters must be user controlled.
Weakness type: CWE-89.
Product: org.postgresql:postgresql (Maven) · Assigned by: PostgreSQL · Published: 2024-02-19
Affected and fixed versions
| Ecosystem | Package | Vulnerable | First fixed |
|---|---|---|---|
| Maven | org.postgresql:postgresql | < 42.2.28 | 42.2.28 |
| Maven | org.postgresql:postgresql | >= 42.3.0, < 42.3.9 | 42.3.9 |
| Maven | org.postgresql:postgresql | >= 42.4.0, < 42.4.4 | 42.4.4 |
| Maven | org.postgresql:postgresql | >= 42.5.0, < 42.5.5 | 42.5.5 |
| Maven | org.postgresql:postgresql | >= 42.6.0, < 42.6.1 | 42.6.1 |
| Maven | org.postgresql:postgresql | >= 42.7.0, < 42.7.2 | 42.7.2 |
| Vendor | Product | Affected versions (per CVE record) |
|---|---|---|
| pgjdbc | pgjdbc | < 42.7.2, < 42.6.1, < 42.5.5, < 42.4.4, < 42.3.9, < 42.2.28 |
Severity scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| PostgreSQL | 3.1 | 10 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| GitHub | 3.1 | 10.0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
- Attack vector: network (remotely reachable)
- Attack complexity: low
- Privileges required: none (no login)
- User interaction: none
- Scope: changed (can affect other components)
CVSS measures how bad a flaw is if exploited, not how likely exploitation is. Read it next to the exploitation data below.
Exploitation and urgency
- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
- CISA SSVC assessment: exploitation poc, automatable yes, technical impact total.
- FIRST EPSS (model of 2026-10-21): 4.81% probability of exploitation activity in the next 30 days; percentile 92.
Timeline
- — CVE record published by PostgreSQL
- — GitHub-reviewed advisory GHSA-24rp-q3w6-vc56 published (critical)
- — CVE record last updated
Sources and references
Original sources first. Version and fix details should always be confirmed against the vendor or project advisory.
Vulnerability records
- GitHub Advisory GHSA-24rp-q3w6-vc56 github.com
- CVE.org record CVE-2024-1597 cve.org
- NVD entry CVE-2024-1597 nvd.nist.gov
Other references from the CVE record and advisory
- github.com github.com
- enterprisedb.com enterprisedb.com
- enterprisedb.com enterprisedb.com
- lists.fedoraproject.org lists.fedoraproject.org
- security.netapp.com security.netapp.com
- openwall.com openwall.com
- lists.debian.org lists.debian.org
- sonarsource.com sonarsource.com
- lists.debian.org lists.debian.org
- github.com github.com
- github.com github.com