pgjdbc SQL Injection via line comment generation
Priority HIGH 82CWE-89Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- SQL injection
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 21 fixed, 7 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-89.
Summary
pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE. Note this is not the default. In the default mode there is no vulnerability. A placeholder for a numeric value must be immediately preceded by a minus. There must be a second placeholder for a string value after the first placeholder; both must be on the same line. By constructing a matching string payload, the attacker can inject SQL to alter the query,bypassing the protections that parameterized queries bring against SQL Injection attacks. Versions before 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9, and 42.2.28 are affected.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0481 92nd percentileScored 2026-11-07
Fix Partial pgjdbc (pgjdbc): 42.7.2, 42.6.1, 42.5.5 +3org.postgresql:postgresql (Maven): 42.2.28, 42.3.9, 42.4.4 +3Red Hat: 14 advisoriesRed Hat: 21 fixed, 7 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| PostgreSQL | pgjdbc | before 42.7.2; before 42.6.1; before 42.5.5; before 42.4.4; before 42.3.9; before 42.2.28 | 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9, 42.2.28 | Patch available | CNA |
| — | org.postgresql:postgresql (Maven) | before 42.2.28 | 42.2.28 | Patch available | GHSA-24rp-q3w6-vc56 |
| — | org.postgresql:postgresql (Maven) | 42.3.0 to before 42.3.9 | 42.3.9 | Patch available | GHSA-24rp-q3w6-vc56 |
| — | org.postgresql:postgresql (Maven) | 42.4.0 to before 42.4.4 | 42.4.4 | Patch available | GHSA-24rp-q3w6-vc56 |
| — | org.postgresql:postgresql (Maven) | 42.5.0 to before 42.5.5 | 42.5.5 | Patch available | GHSA-24rp-q3w6-vc56 |
| — | org.postgresql:postgresql (Maven) | 42.6.0 to before 42.6.1 | 42.6.1 | Patch available | GHSA-24rp-q3w6-vc56 |
| — | org.postgresql:postgresql (Maven) | 42.7.0 to before 42.7.2 | 42.7.2 | Patch available | GHSA-24rp-q3w6-vc56 |
- pgjdbc VendorPostgreSQL Affected before 42.7.2; before 42.6.1; before 42.5.5; before 42.4.4; before 42.3.9; before 42.2.28 Fixed in 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9, 42.2.28 Patch available CNA
- org.postgresql:postgresql (Maven) Vendor— Affected before 42.2.28 Fixed in 42.2.28 Patch available GHSA-24rp-q3w6-vc56
- org.postgresql:postgresql (Maven) Vendor— Affected 42.3.0 to before 42.3.9 Fixed in 42.3.9 Patch available GHSA-24rp-q3w6-vc56
- org.postgresql:postgresql (Maven) Vendor— Affected 42.4.0 to before 42.4.4 Fixed in 42.4.4 Patch available GHSA-24rp-q3w6-vc56
- org.postgresql:postgresql (Maven) Vendor— Affected 42.5.0 to before 42.5.5 Fixed in 42.5.5 Patch available GHSA-24rp-q3w6-vc56
- org.postgresql:postgresql (Maven) Vendor— Affected 42.6.0 to before 42.6.1 Fixed in 42.6.1 Patch available GHSA-24rp-q3w6-vc56
- org.postgresql:postgresql (Maven) Vendor— Affected 42.7.0 to before 42.7.2 Fixed in 42.7.2 Patch available GHSA-24rp-q3w6-vc56
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:postgresql:postgresql_jdbc_driver:*:*:*:*:*:*:*:* | before 42.2.28; 42.3.0 to before 42.3.9; 42.4.0 to before 42.4.4; 42.5.0 to before 42.5.5; 42.6.0 to before 42.6.1; 42.7.0 to before 42.7.2 | Vulnerable | PostgreSQL |
| cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:* | 40 | Vulnerable | Fedoraproject |
- cpe:2.3:a:postgresql:postgresql_jdbc_driver:*:*:*:*:*:*:*:* Versions before 42.2.28; 42.3.0 to before 42.3.9; 42.4.0 to before 42.4.4; 42.5.0 to before 42.5.5; 42.6.0 to before 42.6.1; 42.7.0 to before 42.7.2 Vulnerable ·PostgreSQL
- cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:* Versions 40 Vulnerable ·Fedoraproject
Remediation
- Fix · CNA pgjdbc (pgjdbc) Fixed in 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9, 42.2.28
- Fix · GHSA-24rp-q3w6-vc56 org.postgresql:postgresql (Maven) Fixed in 42.2.28 Advisory →
- Fix · GHSA-24rp-q3w6-vc56 org.postgresql:postgresql (Maven) Fixed in 42.3.9 Advisory →
- Fix · GHSA-24rp-q3w6-vc56 org.postgresql:postgresql (Maven) Fixed in 42.4.4 Advisory →
- Fix · GHSA-24rp-q3w6-vc56 org.postgresql:postgresql (Maven) Fixed in 42.5.5 Advisory →
- Fix · GHSA-24rp-q3w6-vc56 org.postgresql:postgresql (Maven) Fixed in 42.6.1 Advisory →
- Fix · GHSA-24rp-q3w6-vc56 org.postgresql:postgresql (Maven) Fixed in 42.7.2 Advisory →
Red Hat 14 advisories
- RHSA-2024:5056 Released 2024-08-06 · Red Hat rating ImportantRed Hat Integration Camel K 1.10.7 release and security update.
- RHINT Camel-K 1.10.7
- RHSA-2024:4884 Released 2024-07-25 · Red Hat rating ImportantRed Hat Build of Apache Camel 4.4.1 for Spring Boot security update.
- Red Hat build of Apache Camel 4.4.1 for Spring Boot 3.2
- RHSA-2024:4402 Released 2024-07-09 · Red Hat rating Importantpostgresql-jdbc security update
- Red Hat Enterprise Linux AppStream AUS (v.8.6) postgresql-jdbc-42.2.3-5.el8_6, postgresql-jdbc-javadoc-42.2.3-5.el8_6
- Red Hat Enterprise Linux AppStream E4S (v.8.6) postgresql-jdbc-42.2.3-5.el8_6, postgresql-jdbc-javadoc-42.2.3-5.el8_6
- Red Hat Enterprise Linux AppStream TUS (v.8.6) postgresql-jdbc-42.2.3-5.el8_6, postgresql-jdbc-javadoc-42.2.3-5.el8_6
Show 11 more Red Hat advisories
- RHSA-2024:4375 Released 2024-07-08 · Red Hat rating Importantpostgresql-jdbc security update
- Red Hat Enterprise Linux AppStream AUS (v.8.4) postgresql-jdbc-42.2.3-7.el8_4, postgresql-jdbc-javadoc-42.2.3-7.el8_4
- Red Hat Enterprise Linux AppStream E4S (v.8.4) postgresql-jdbc-42.2.3-7.el8_4, postgresql-jdbc-javadoc-42.2.3-7.el8_4
- Red Hat Enterprise Linux AppStream TUS (v.8.4) postgresql-jdbc-42.2.3-7.el8_4, postgresql-jdbc-javadoc-42.2.3-7.el8_4
- RHSA-2024:4057 Released 2024-06-24 · Red Hat rating ImportantRelease of OpenShift Serverless Logic 1.33.0 security update & enhancements
- Red Hat OpenShift Serverless 1.33 openshift-serverless-1/logic-data-index-ephemeral-rhel8, openshift-serverless-1/logic-data-index-postgresql-rhel8, openshift-serverless-1/logic-jobs-service-ephemeral-rhel8 +6
- RHSA-2024:3313 Released 2024-05-23 · Red Hat rating Importantpostgresql-jdbc security update
- Red Hat Enterprise Linux AppStream EUS (v.8.8) postgresql-jdbc-42.2.14-5.el8_8, postgresql-jdbc-javadoc-42.2.14-5.el8_8
- RHSA-2024:2624 Released 2024-04-30 · Red Hat rating Importantpostgresql-jdbc : Security Update
- Red Hat Enterprise Linux AppStream AUS (v. 8.2) postgresql-jdbc-42.2.3-5.el8_2, postgresql-jdbc-javadoc-42.2.3-5.el8_2
- Red Hat Enterprise Linux AppStream E4S (v. 8.2) postgresql-jdbc-42.2.3-5.el8_2, postgresql-jdbc-javadoc-42.2.3-5.el8_2
- Red Hat Enterprise Linux AppStream TUS (v. 8.2) postgresql-jdbc-42.2.3-5.el8_2, postgresql-jdbc-javadoc-42.2.3-5.el8_2
- RHSA-2024:1999 Released 2024-04-23 · Red Hat rating Importantpostgresql-jdbc security update
- Red Hat Enterprise Linux AppStream EUS (v.9.0) postgresql-jdbc-42.2.28-1.el9_0
- RHSA-2024:1797 Released 2024-04-22 · Red Hat rating ImportantRed Hat build of Quarkus 2.13.9.SP2 release and security update
- Red Hat build of Quarkus 2.13.9.SP2 org.apache.commons.commons-compress-1.26.1.redhat-00001.jar, org.postgresql.postgresql-42.5.6.redhat-00001.jar
- RHSA-2024:1686 Released 2024-04-04 · Red Hat rating ModerateRed Hat Single Sign-On 7.6.7 for OpenShift image security update
- Middleware Containers for OpenShift rh-sso-7/sso7-rhel8-operator-bundle, rh-sso-7/sso76-openshift-rhel8
- RHSA-2024:1662 Released 2024-04-03 · Red Hat rating ImportantRed Hat build of Quarkus 3.2.11 release and security update
- Red Hat build of Quarkus 3.2.11.Final io.quarkus.quarkus-kubernetes-deployment-3.2.11.Final-redhat-00001.jar, io.quarkus.quarkus-resteasy-reactive-3.2.11.Final-redhat-00001.jar, io.vertx.vertx-core-4.4.8.redhat-00001.jar +2
- RHSA-2024:1649 Released 2024-04-02 · Red Hat rating Importantpostgresql-jdbc: security update
- Red Hat Enterprise Linux AppStream EUS (v.9.2) postgresql-jdbc-42.2.28-1.el9_2
- RHSA-2024:1436 Released 2024-03-20 · Red Hat rating Importantpostgresql-jdbc security update
- Red Hat Enterprise Linux AppStream (v. 9) postgresql-jdbc-42.2.28-1.el9_3
- RHSA-2024:1435 Released 2024-03-20 · Red Hat rating Importantpostgresql-jdbc security update
- Red Hat Enterprise Linux AppStream (v. 8) postgresql-jdbc-42.2.14-3.el8_9, postgresql-jdbc-javadoc-42.2.14-3.el8_9
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 8 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 9 | Affected | No fix planned: Will not fix |
| Red Hat Integration Camel Quarkus 2 | Affected | No fix planned: Will not fix |
| Red Hat Process Automation 7 | Affected | No fix planned: Will not fix |
| Red Hat build of Apache Camel 4 for Quarkus 3 | Affected | No fix planned: Will not fix |
| Red Hat build of Apache Camel for Spring Boot 3 | Affected | No fix yet |
| Red Hat build of OptaPlanner 8 | Affected | No fix planned: Will not fix |
| Middleware Containers for OpenShift | Fixed | RHSA-2024:1686 |
| RHINT Camel-K 1.10.7 | Fixed | RHSA-2024:5056 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2024:1435 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2024:1436 |
| Red Hat Enterprise Linux AppStream AUS (v. 8.2) | Fixed | RHSA-2024:2624 |
| Red Hat Enterprise Linux AppStream AUS (v.8.4) | Fixed | RHSA-2024:4375 |
| Red Hat Enterprise Linux AppStream AUS (v.8.6) | Fixed | RHSA-2024:4402 |
| Red Hat Enterprise Linux AppStream E4S (v. 8.2) | Fixed | RHSA-2024:2624 |
| Red Hat Enterprise Linux AppStream E4S (v.8.4) | Fixed | RHSA-2024:4375 |
| Red Hat Enterprise Linux AppStream E4S (v.8.6) | Fixed | RHSA-2024:4402 |
| Red Hat Enterprise Linux AppStream EUS (v.8.8) | Fixed | RHSA-2024:3313 |
| Red Hat Enterprise Linux AppStream EUS (v.9.0) | Fixed | RHSA-2024:1999 |
| Red Hat Enterprise Linux AppStream EUS (v.9.2) | Fixed | RHSA-2024:1649 |
| Red Hat Enterprise Linux AppStream TUS (v. 8.2) | Fixed | RHSA-2024:2624 |
| Red Hat Enterprise Linux AppStream TUS (v.8.4) | Fixed | RHSA-2024:4375 |
| Red Hat Enterprise Linux AppStream TUS (v.8.6) | Fixed | RHSA-2024:4402 |
| Red Hat OpenShift Serverless 1.33 | Fixed | RHSA-2024:4057 |
| Red Hat build of Apache Camel 4.4.1 for Spring Boot 3.2 | Fixed | RHSA-2024:4884 |
| Red Hat build of Keycloak 24 | Fixed | — |
| Red Hat build of Quarkus 2.13.9.SP2 | Fixed | RHSA-2024:1797 |
| Red Hat build of Quarkus 3.2.11.Final | Fixed | RHSA-2024:1662 |
Not affected: 9 products
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Fuse 7
- Red Hat JBoss Enterprise Application Platform 8
- Red Hat Satellite 6
- Red Hat Virtualization 4
- Red Hat build of Apicurio Registry 2
- Red Hat build of Quarkus 2.13.9.SP2
- Red Hat build of Quarkus 3.2.11.Final
Timeline
- 2026-10-02 Threatist record created from CVE-2024-1597
- 2026-10-03 Alias added: GHSA-24rp-q3w6-vc56
References
Advisory 4
Other 7
- https://www.enterprisedb.com/docs/jdbc_connector/latest/01_jdbc_rel_notes/
- https://security.netapp.com/advisory/ntap-20240419-0008/
- http://www.openwall.com/lists/oss-security/2024/04/02/6
- https://lists.debian.org/debian-lts-announce/2024/05/msg00007.html
- https://github.com/pgjdbc/pgjdbc/commit/06abfb78a627277a580d4df825f210e96a4e14ee
- https://github.com/pgjdbc/pgjdbc/commit/93b0fcb2711d9c1e3a2a03134369738a02a58b40
- https://github.com/pgjdbc/pgjdbc
More Postgresql Jdbc Driver vulnerabilities
- TI-2022-06097 Unchecked Class Instantiation when providing Plugin Classes CVSS 3.1CRITICAL 9.8
- TI-2022-13237 SQL Injection in ResultSet.refreshRow() with malicious column names in pgjdbc CVSS 3.1HIGH 8.0
- TI-2022-09860 In pgjdbc before 42.3.3, an attacker (who controls the jdbc URL or properties) can call… CVSS 3.1CRITICAL 9.8
- TI-2026-30519 pgjdbc: Unbounded PBKDF2 iterations in SCRAM authentication allows CPU exhaustion DoS CVSS 3.1HIGH 7.5
- TI-2025-31226 pgjdbc Client Allows Fallback to Insecure Authentication Despite channelBinding=require Configuration CVSS 3.1HIGH 8.2
- TI-2020-10739 PostgreSQL JDBC Driver (aka PgJDBC) before 42.2.13 allows XXE. CVSS 3.1HIGH 7.7
Sources
- CVE-2024-1597 · CVE Program
- CVE-2024-1597 · NVD
- FIRST EPSS
- GHSA-24rp-q3w6-vc56 · GitHub Advisory Database · CC BY 4.0
- CVE-2024-1597 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences