CVE-2024-32655
1 advisory.
NuGet/Npgsql CVE-2024-32655: high 8.1
Npgsql vulnerable to SQL Injection via Protocol Message Size Overflow
Action: Upgrade Npgsql to 4.0.14 (4.0.x), 4.1.13 (4.1.x), 5.0.18 (5.0.x), 6.0.11 (6.0.x), 7.0.7 (7.0.x) or 8.0.3 (8.0.x) or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 8.0.0 | 8.0.3 | - |
| 0 | 4.0.14 | - |
| 4.1.0 | 4.1.13 | - |
| 5.0.0 | 5.0.18 | - |
| 6.0.0 | 6.0.11 | - |
| 7.0.0 | 7.0.7 | - |
Fixed versions
| 8.0.3 | 4.0.14 | 4.1.13 | 5.0.18 | 6.0.11 | 7.0.7 |
Sources
- osv: GHSA-x9vc-6hfv-hg8c
- https://github.com/npgsql/npgsql/security/advisories/GHSA-x9vc-6hfv-hg8c
- https://nvd.nist.gov/vuln/detail/CVE-2024-32655
- https://github.com/npgsql/npgsql/commit/091655eed0c84e502ab424950c930339d17c1928
- https://github.com/npgsql/npgsql/commit/3183efb2bdcca159c8c2e22af57e18ea8f853cf0
- https://github.com/npgsql/npgsql/commit/67acbe027e28477ac2199e15cfb554bb2ffaf169
- https://github.com/npgsql/npgsql/commit/703d9af8fa48dfe8c0180e36edb8278f34342d7b
- https://github.com/npgsql/npgsql/commit/a22a42d8141d7a3528f43c02c095a409507cf1af
- https://github.com/npgsql/npgsql/commit/e34e2ba8042e666d9af54a1b255fba4d5b11df56
- https://github.com/npgsql/npgsql/commit/f7e7ead0702d776a8f551f5786c4cac2d65c4bc6
- https://www.youtube.com/watch?v=Tfg1B8u1yvE
- https://github.com/npgsql/npgsql/releases/tag/v8.0.3
- https://github.com/npgsql/npgsql/releases/tag/v7.0.7
- https://github.com/npgsql/npgsql/releases/tag/v6.0.11
- https://github.com/npgsql/npgsql/releases/tag/v5.0.18
- https://github.com/npgsql/npgsql/releases/tag/v4.1.13
- https://github.com/npgsql/npgsql/releases/tag/v4.0.14
- https://github.com/npgsql/npgsql/files/14309397/npgsql-protocol-overflow-poc.zip
- https://github.com/npgsql/npgsql/files/14309386/Npgsql.Security.Advisory.pdf
- https://github.com/npgsql/npgsql
CVE-2024-32655 · published · modified · JSON