CVE-2024-27304
CriticalSummary
In the pgx library, a PostgreSQL driver for Go, a SQL injection vulnerability can occur if an attacker causes a single query or bind message to exceed 4 GB. An integer overflow in the calculated message size can cause one large message to be sent as multiple messages under the attacker's control.
Risk Assessment
This vulnerability could lead to unauthorized access to database data and allow attackers to manipulate SQL queries, potentially resulting in serious security implications for the organization.
Recommendation
It is recommended to upgrade to version 4.18.2 or 5.5.4 to mitigate this vulnerability. Alternatively, user input large enough to cause a single query or bind message to exceed 4 GB should be rejected.
Original NVD description (English source)
pgx is a PostgreSQL driver and toolkit for Go. SQL injection can occur if an attacker can cause a single query or bind message to exceed 4 GB in size. An integer overflow in the calculated message size can cause the one large message to be sent as multiple messages under the attacker's control. The problem is resolved in v4.18.2 and v5.5.4. As a workaround, reject user input large enough to cause a single query or bind message to exceed 4 GB in size.