PT-2019-12164 · Postgresql · Sequelize

Published 2019-04-10 · Updated 2023-11-17 · CVE-2019-11069

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Sequelize versions prior to 5.3.0

Description The issue arises from the improper handling of backslashes in string literals, potentially allowing attackers to inject SQL statements. This is due to the PostgreSQL option standard conforming strings not being set to on by default.

Recommendations Upgrade to version 5.3.0 or later.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2019-11069

GHSA-2777-2VQ8-C4V4

Affected Products

Sequelize

References · 11

• https://github.com/sequelize/sequelize/pull/10746/files · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2019-11069 · Security Note
• https://osv.dev/vulnerability/GHSA-2777-2vq8-c4v4 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-11069 · Vendor Advisory
• https://github.com/sequelize/sequelize · Note
• https://github.com/sequelize/sequelize/blob/98cb17c17f73e2aa1792aa5a1d31216ba984b456/lib/dialects/postgres/connection-manager.js#L158-L160 · Note
• https://github.com/sequelize/sequelize/commit/850c7fd04669e0fef9238b6dc4f8d6ee93ed71e9 · Note
• https://github.com/sequelize/sequelize/releases/tag/v5.3.0 · Note
• https://github.com/sequelize/sequelize/pull/10746 · Note
• https://t.me/cvenotify/60645 · Telegram Post
• https://snyk.io/vuln/SNYK-JS-SEQUELIZE-174167 · Note