PT-2025-25328 · Go-Pg+1 · Go-Pg+1

Publicado 2025-06-12 · Atualizado 2026-01-26 · CVE-2024-44905

Positive Technologies (AI Summary) · Pt

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Nome do Software Vulnerável e Versões Afetadas go-pg pg versão 10.13.0

Descrição Uma vulnerabilidade de injeção de SQL foi descoberta no componente /types/append value.go. Isso possibilita potenciais ataques de injeção de SQL.

Recomendações Para a versão 10.13.0 do go-pg pg, considere restringir o acesso à função append value no componente /types/append value.go até que um patch esteja disponível.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2024-44905

GHSA-6XP3-P59P-Q4FJ

GO-2025-3764

OPENSUSE-SU-2025:15405-1

SUSE-SU-2026:0037-1

SUSE-SU-2026:0292-1

Produtos afetados

Debian

Go-Pg

Referências · 170

• 🔥 https://media.defcon.org/DEF%20CON%2032/DEF%20CON%2032%20presentations/DEF%20CON%2032%20-%20Paul%20Gerste%20-%20SQL%20Injection%20Isn%27t%20Dead%20Smuggling%20Queries%20at%20the%20Protocol%20Level.pdf · Exploit
• 🔥 https://sonarsource.com/blog/double-dash-double-trouble-a-subtle-sql-injection-flaw · Exploit
• https://github.com/go-pg/pg/releases/tag/v10.15.0 · Nota
• https://github.com/go-pg/pg/commit/eff50a43724e52347559687a6945c116afbb41c1 · Nota
• https://github.com/go-pg/pg · Nota
• https://github.com/go-pg/pg/blob/30e7053c6cacdd44d06cf2b92183b49188b7c922/types/append_value.go#L151 · Nota
• https://suse.com/security/cve/CVE-2025-68941 · Nota
• https://suse.com/security/cve/CVE-2025-67508 · Nota
• https://suse.com/security/cve/CVE-2025-60633 · Nota
• https://suse.com/security/cve/CVE-2025-68939 · Nota
• https://osv.dev/vulnerability/GO-2025-3764 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2025-66508 · Nota
• https://suse.com/security/cve/CVE-2025-68388 · Nota
• https://suse.com/security/cve/CVE-2025-64708 · Nota
• https://suse.com/security/cve/CVE-2025-67499 · Nota