PT-2024-2157 · Pgx+2 · Pgx+2

Paul-Gerste-Sonarsource · Published 2024-03-04 · Updated 2026-05-21 · CVE-2024-27289

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions pgx versions prior to 4.18.2

Description The issue is related to SQL injection in the pgx PostgreSQL driver and toolkit for Go. It occurs when the non-default simple protocol is used, a placeholder for a numeric value is immediately preceded by a minus, there is a second placeholder for a string value after the first placeholder on the same line, and both parameter values are user-controlled. This allows an attacker to execute arbitrary SQL queries.

Recommendations As a temporary workaround, do not use the simple protocol or do not place a minus directly before a placeholder. For versions prior to 4.18.2, update to version 4.18.2 to resolve the issue.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

ALSA-2025_16880

ALT-PU-2024-12202

ALT-PU-2024-12410

ALT-PU-2024-9408

ALT-PU-2024-9897

AZL-35750

AZL-35763

BDU:2024-02067

CVE-2024-27289

GHSA-M7WR-2XF7-CM9P

GO-2024-2605

Affected Products

Alt Linux

Debian

Pgx

References · 23

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/27xxx/CVE-2024-27289.json · Exploit
• https://github.com/jackc/pgx/commit/f94eb0e2f96782042c96801b5ac448f44f0a81df · Patch
• https://github.com/jackc/pgx/security/advisories/GHSA-m7wr-2xf7-cm9p · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-27289 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-2605 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-27289 · Security Note
• https://osv.dev/vulnerability/AZL-35750 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-27289 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-35763 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-27289 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-27289 · Security Note
• https://ubuntu.com/security/CVE-2024-27289 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-27289 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-02067 · Security Note
• https://osv.dev/vulnerability/GHSA-m7wr-2xf7-cm9p · Vendor Advisory