OESA-2024-1237

See a problem?
Please try reporting it to the source first.

Source

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1237

Import Source

https://repo.openeuler.org/security/data/osv/OESA-2024-1237.json

JSON Data

https://api.test.osv.dev/v1/vulns/OESA-2024-1237

Upstream

CVE-2024-1597

Published

2024-03-01T11:07:07Z

Modified

2025-08-12T05:24:59.346045Z

Summary

postgresql-jdbc security update

Details

PostgreSQL JDBC Driver (PgJDBC for short) allows Java programs to connect to a PostgreSQL database using standard, database independent Java code. Is an open source JDBC driver written in Pure Java (Type 4), and communicates in the PostgreSQL native network protocol.

Security Fix(es):

pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE. Note this is not the default. In the default mode there is no vulnerability. A placeholder for a numeric value must be immediately preceded by a minus. There must be a second placeholder for a string value after the first placeholder; both must be on the same line. By constructing a matching string payload, the attacker can inject SQL to alter the query,bypassing the protections that parameterized queries bring against SQL Injection attacks. Versions before 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9, and 42.2.8 are affected.(CVE-2024-1597)

Database specific

{
    "severity": "Critical"
}

References

Affected packages

openEuler:20.03-LTS-SP1 / postgresql-jdbc

Package

Name: postgresql-jdbc
Purl: pkg:rpm/openEuler/postgresql-jdbc&distro=openEuler-20.03-LTS-SP1

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

42.4.1-3.oe1

Ecosystem specific

{
    "noarch": [
        "postgresql-jdbc-help-42.4.1-3.oe1.noarch.rpm",
        "postgresql-jdbc-42.4.1-3.oe1.noarch.rpm",
        "postgresql-jdbc-javadoc-42.4.1-3.oe1.noarch.rpm"
    ],
    "src": [
        "postgresql-jdbc-42.4.1-3.oe1.src.rpm"
    ]
}

openEuler:20.03-LTS-SP4 / postgresql-jdbc

Package

Name: postgresql-jdbc
Purl: pkg:rpm/openEuler/postgresql-jdbc&distro=openEuler-20.03-LTS-SP4

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

42.4.1-3.oe2003sp4

Ecosystem specific

{
    "noarch": [
        "postgresql-jdbc-help-42.4.1-3.oe2003sp4.noarch.rpm",
        "postgresql-jdbc-javadoc-42.4.1-3.oe2003sp4.noarch.rpm",
        "postgresql-jdbc-42.4.1-3.oe2003sp4.noarch.rpm"
    ],
    "src": [
        "postgresql-jdbc-42.4.1-3.oe2003sp4.src.rpm"
    ]
}

openEuler:22.03-LTS / postgresql-jdbc

Package

Name: postgresql-jdbc
Purl: pkg:rpm/openEuler/postgresql-jdbc&distro=openEuler-22.03-LTS

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

42.4.1-3.oe2203sp3

Ecosystem specific

{
    "noarch": [
        "postgresql-jdbc-javadoc-42.4.1-3.oe2203.noarch.rpm",
        "postgresql-jdbc-42.4.1-3.oe2203.noarch.rpm",
        "postgresql-jdbc-help-42.4.1-3.oe2203.noarch.rpm",
        "postgresql-jdbc-help-42.4.1-3.oe2203sp1.noarch.rpm",
        "postgresql-jdbc-42.4.1-3.oe2203sp1.noarch.rpm",
        "postgresql-jdbc-javadoc-42.4.1-3.oe2203sp1.noarch.rpm",
        "postgresql-jdbc-help-42.4.1-3.oe2203sp2.noarch.rpm",
        "postgresql-jdbc-42.4.1-3.oe2203sp2.noarch.rpm",
        "postgresql-jdbc-javadoc-42.4.1-3.oe2203sp2.noarch.rpm",
        "postgresql-jdbc-javadoc-42.4.1-3.oe2203sp3.noarch.rpm",
        "postgresql-jdbc-42.4.1-3.oe2203sp3.noarch.rpm",
        "postgresql-jdbc-help-42.4.1-3.oe2203sp3.noarch.rpm"
    ],
    "src": [
        "postgresql-jdbc-42.4.1-3.oe2203.src.rpm",
        "postgresql-jdbc-42.4.1-3.oe2203sp1.src.rpm",
        "postgresql-jdbc-42.4.1-3.oe2203sp2.src.rpm",
        "postgresql-jdbc-42.4.1-3.oe2203sp3.src.rpm"
    ]
}

openEuler:22.03-LTS-SP1 / postgresql-jdbc

Package

Name: postgresql-jdbc
Purl: pkg:rpm/openEuler/postgresql-jdbc&distro=openEuler-22.03-LTS-SP1

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

42.4.1-3.oe2203sp1

Ecosystem specific

{
    "noarch": [
        "postgresql-jdbc-help-42.4.1-3.oe2203sp1.noarch.rpm",
        "postgresql-jdbc-42.4.1-3.oe2203sp1.noarch.rpm",
        "postgresql-jdbc-javadoc-42.4.1-3.oe2203sp1.noarch.rpm"
    ],
    "src": [
        "postgresql-jdbc-42.4.1-3.oe2203sp1.src.rpm"
    ]
}

openEuler:22.03-LTS-SP2 / postgresql-jdbc

Package

Name: postgresql-jdbc
Purl: pkg:rpm/openEuler/postgresql-jdbc&distro=openEuler-22.03-LTS-SP2

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

42.4.1-3.oe2203sp2

Ecosystem specific

{
    "noarch": [
        "postgresql-jdbc-help-42.4.1-3.oe2203sp2.noarch.rpm",
        "postgresql-jdbc-42.4.1-3.oe2203sp2.noarch.rpm",
        "postgresql-jdbc-javadoc-42.4.1-3.oe2203sp2.noarch.rpm"
    ],
    "src": [
        "postgresql-jdbc-42.4.1-3.oe2203sp2.src.rpm"
    ]
}

openEuler:22.03-LTS-SP3 / postgresql-jdbc

Package

Name: postgresql-jdbc
Purl: pkg:rpm/openEuler/postgresql-jdbc&distro=openEuler-22.03-LTS-SP3

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

42.4.1-3.oe2203sp3

Ecosystem specific

{
    "noarch": [
        "postgresql-jdbc-javadoc-42.4.1-3.oe2203sp3.noarch.rpm",
        "postgresql-jdbc-42.4.1-3.oe2203sp3.noarch.rpm",
        "postgresql-jdbc-help-42.4.1-3.oe2203sp3.noarch.rpm"
    ],
    "src": [
        "postgresql-jdbc-42.4.1-3.oe2203sp3.src.rpm"
    ]
}