PT-2019-14326 · Pg · Connect-Pg-Simple

Voxpelli · Publicado 2019-08-26 · Atualizado 2019-08-30 · CVE-2019-15658

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions connect-pg-simple versions prior to 6.0.1

Description The issue allows for SQL injection if the tableName or schemaName is untrusted data. This can occur when an unsanitized table name input is used.

Recommendations For versions prior to 6.0.1, upgrade to version 6.0.1 to resolve the issue. As a temporary workaround for versions that cannot be upgraded, sanitize and escape the tableName and schemaName options before sending them to the constructor, but note that such escaping would need to be removed when upgrading to 6.0.1 or later to avoid double escaping.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2019-15658

GHSA-XQH8-5J36-4556

Produtos afetados

Connect-Pg-Simple

Referências · 8

• https://github.com/voxpelli/node-connect-pg-simple/security/advisories/GHSA-xqh8-5j36-4556 · Nota
• https://github.com/voxpelli/node-connect-pg-simple · Nota
• https://snyk.io/vuln/SNYK-JS-CONNECTPGSIMPLE-460154 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-15658 · Nota de Segurança
• https://github.com/advisories/GHSA-xqh8-5j36-4556 · Nota
• https://osv.dev/vulnerability/GHSA-xqh8-5j36-4556 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-15658 · Aviso do Fabricante
• https://npmjs.com/advisories/1153 · Nota