PT-2019-12164 · Postgresql · Sequelize

CVE-2019-11069 · Publicado 2019-04-10 · Atualizado 2023-11-17

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Sequelize versions prior to 5.3.0

Description The issue arises from the improper handling of backslashes in string literals, potentially allowing attackers to inject SQL statements. This is due to the PostgreSQL option standard conforming strings not being set to on by default.

Recommendations Upgrade to version 5.3.0 or later.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2019-11069

GHSA-2777-2VQ8-C4V4

Produtos afetados

Sequelize

Referências · 11

• https://github.com/sequelize/sequelize · Nota
• https://github.com/sequelize/sequelize/blob/98cb17c17f73e2aa1792aa5a1d31216ba984b456/lib/dialects/postgres/connection-manager.js#L158-L160 · Nota
• https://github.com/sequelize/sequelize/pull/10746/files · Correção
• https://github.com/sequelize/sequelize/commit/850c7fd04669e0fef9238b6dc4f8d6ee93ed71e9 · Nota
• https://github.com/sequelize/sequelize/releases/tag/v5.3.0 · Nota
• https://github.com/sequelize/sequelize/pull/10746 · Nota
• https://t.me/cvenotify/60645 · Publicação no Telegram
• https://snyk.io/vuln/SNYK-JS-SEQUELIZE-174167 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-11069 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-2777-2vq8-c4v4 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-11069 · Aviso do Fabricante