PT-2019-14326 · Pg · Connect-Pg-Simple

Voxpelli · Published 2019-08-26 · Updated 2019-08-30 · CVE-2019-15658

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions connect-pg-simple versions prior to 6.0.1

Description The issue allows for SQL injection if the tableName or schemaName is untrusted data. This can occur when an unsanitized table name input is used.

Recommendations For versions prior to 6.0.1, upgrade to version 6.0.1 to resolve the issue. As a temporary workaround for versions that cannot be upgraded, sanitize and escape the tableName and schemaName options before sending them to the constructor, but note that such escaping would need to be removed when upgrading to 6.0.1 or later to avoid double escaping.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2019-15658

GHSA-XQH8-5J36-4556

Affected Products

Connect-Pg-Simple

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2019-15658 · Security Note
• https://osv.dev/vulnerability/GHSA-xqh8-5j36-4556 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-15658 · Vendor Advisory
• https://github.com/voxpelli/node-connect-pg-simple/security/advisories/GHSA-xqh8-5j36-4556 · Note
• https://github.com/voxpelli/node-connect-pg-simple · Note
• https://snyk.io/vuln/SNYK-JS-CONNECTPGSIMPLE-460154 · Note
• https://github.com/advisories/GHSA-xqh8-5j36-4556 · Note
• https://npmjs.com/advisories/1153 · Note