Go/github.com/jackc/pgx CVE-2024-27304: critical 9.8, EPSS 1.11%
pgx SQL Injection via Protocol Message Size Overflow
Action: Upgrade github.com/jackc/pgx to 4.18.2 or later.
go get github.com/jackc/pgx@v4.18.2go get github.com/jackc/pgx@v5.5.4Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 4.18.2 | - |
| 5.0.0 | 5.5.4 | - |
Fixed versions
| 4.18.2 | 5.5.4 |
Sources
- osv: GHSA-mrww-27vc-gghv
- https://github.com/jackc/pgproto3/security/advisories/GHSA-7jwh-3vrq-q3m8
- https://github.com/jackc/pgx/security/advisories/GHSA-mrww-27vc-gghv
- https://nvd.nist.gov/vuln/detail/CVE-2024-27304
- https://github.com/jackc/pgproto3/commit/945c2126f6db8f3bea7eeebe307c01fe92bca007
- https://github.com/jackc/pgx/commit/adbb38f298c76e283ffc7c7a3f571036fea47fd4
- https://github.com/jackc/pgx/commit/c543134753a0c5d22881c12404025724cb05ffd8
- https://github.com/jackc/pgx/commit/f94eb0e2f96782042c96801b5ac448f44f0a81df
- https://github.com/jackc/pgx
- https://www.youtube.com/watch?v=Tfg1B8u1yvE
CVE-2024-27304 · published · modified · JSON