{"id":"CVE-2024-1597","aliases":["ALPINE-CVE-2024-1597","ALSA-2024:1435","ALSA-2024:1436","BIT-postgresql-jdbc-driver-2024-1597","CLSA-2025-1754870602","CLSA-2025-1754870603","CLSA-2025-1762243790","CLSA-2026-1781608329","DEBIAN-CVE-2024-1597","DLA-3812-1","DLA-3995-1","EUVD-2024-0465","GHSA-24rp-q3w6-vc56","GHSA-562r-vg33-8x8h","GHSA-98qh-xjc8-98pq","GHSA-r38f-c4h4-hqq2","MGASA-2024-0120","OESA-2024-1237","RHLW-2026-b44d1f7dac7a0d3d","RHSA-2024:1435","RHSA-2024:1436","RHSA-2024:1649","RHSA-2024:1999","RHSA-2024:2624","RHSA-2024:3313","RHSA-2024:4375","RHSA-2024:4402","RLSA-2024:1435","RLSA-2024:1436","ROOT-APP-MAVEN-CVE-2024-1597","SUSE-SU-2024:0769-1","SUSE-SU-2024:0771-1","SUSE-SU-2024:0773-1","UBUNTU-CVE-2024-1597","openSUSE-SU-2024:13734-1"],"status":"published","title":"pgjdbc SQL Injection via line comment generation","description":"pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE. Note this is not the default. In the default mode there is no vulnerability. A placeholder for a numeric value must be immediately preceded by a minus. There must be a second placeholder for a string value after the first placeholder; both must be on the same line. By constructing a matching string payload, the attacker can inject SQL to alter the query,bypassing the protections that parameterized queries bring against SQL Injection attacks. Versions before 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9, and 42.2.28 are affected.","severity":{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.0481,"percentile":0.92026,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-89"],"published":"2024-02-19T12:58:48Z","modified":"2026-11-04T20:02:18Z","fixes":[{"ecosystem":"Maven","package":"org.postgresql:postgresql","fixed_in":["42.2.28","42.3.9","42.4.4","42.5.5","42.6.1","42.7.2"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.19","package":"java-postgresql-jdbc","fixed_in":["42.6.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"java-postgresql-jdbc","fixed_in":["42.6.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"java-postgresql-jdbc","fixed_in":["42.6.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"java-postgresql-jdbc","fixed_in":["42.6.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"java-postgresql-jdbc","fixed_in":["42.6.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"java-postgresql-jdbc","fixed_in":["42.6.2-r0"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"postgresql-jdbc","fixed_in":["42.2.14-3.el8_9"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"postgresql-jdbc-javadoc","fixed_in":["42.2.14-3.el8_9"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"postgresql-jdbc","fixed_in":["42.2.28-1.el9_3"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"postgresql-jdbc-driver","fixed_in":["42.2.28","42.3.9","42.4.4","42.5.5","42.6.1","42.7.2"],"sources":["osv"]},{"ecosystem":"TuxCare:Maven","package":"org.postgresql:postgresql","fixed_in":["42.5.0-tuxcare.1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"postgresql-jdbc","fixed_in":["42.2.28-1.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"postgresql-jdbc-javadoc","fixed_in":["42.2.28-1.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libpgjava","fixed_in":["42.5.5-0+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libpgjava","fixed_in":["42.7.2-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libpgjava","fixed_in":["42.7.2-1"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"libpgjava","fixed_in":["42.2.5-2+deb10u4"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"postgresql-jdbc","fixed_in":["42.5.6-1.mga9"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"postgresql-jdbc","fixed_in":["42.4.1-3.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"postgresql-jdbc","fixed_in":["42.4.1-3.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"postgresql-jdbc","fixed_in":["42.4.1-3.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"postgresql-jdbc","fixed_in":["42.4.1-3.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP2","package":"postgresql-jdbc","fixed_in":["42.4.1-3.oe2203sp2"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"postgresql-jdbc","fixed_in":["42.4.1-3.oe2203sp3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"postgresql-jdbc","fixed_in":["0:42.2.14-3.el8_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"postgresql-jdbc-javadoc","fixed_in":["0:42.2.14-3.el8_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgresql-jdbc","fixed_in":["0:42.2.28-1.el9_3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"postgresql-jdbc","fixed_in":["0:42.2.28-1.el9_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.0::appstream","package":"postgresql-jdbc","fixed_in":["0:42.2.28-1.el9_0"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"postgresql-jdbc","fixed_in":["0:42.2.3-5.el8_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"postgresql-jdbc-javadoc","fixed_in":["0:42.2.3-5.el8_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.2::appstream","package":"postgresql-jdbc","fixed_in":["0:42.2.3-5.el8_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.2::appstream","package":"postgresql-jdbc-javadoc","fixed_in":["0:42.2.3-5.el8_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.2::appstream","package":"postgresql-jdbc","fixed_in":["0:42.2.3-5.el8_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.2::appstream","package":"postgresql-jdbc-javadoc","fixed_in":["0:42.2.3-5.el8_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"postgresql-jdbc","fixed_in":["0:42.2.14-5.el8_8"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"postgresql-jdbc-javadoc","fixed_in":["0:42.2.14-5.el8_8"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"postgresql-jdbc","fixed_in":["0:42.2.3-7.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"postgresql-jdbc-javadoc","fixed_in":["0:42.2.3-7.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"postgresql-jdbc","fixed_in":["0:42.2.3-7.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"postgresql-jdbc-javadoc","fixed_in":["0:42.2.3-7.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"postgresql-jdbc","fixed_in":["0:42.2.3-7.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"postgresql-jdbc-javadoc","fixed_in":["0:42.2.3-7.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"postgresql-jdbc","fixed_in":["0:42.2.3-5.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"postgresql-jdbc-javadoc","fixed_in":["0:42.2.3-5.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"postgresql-jdbc","fixed_in":["0:42.2.3-5.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"postgresql-jdbc-javadoc","fixed_in":["0:42.2.3-5.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"postgresql-jdbc","fixed_in":["0:42.2.3-5.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"postgresql-jdbc-javadoc","fixed_in":["0:42.2.3-5.el8_6"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"postgresql-jdbc","fixed_in":["0:42.2.14-3.el8_9"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"postgresql-jdbc","fixed_in":["0:42.2.28-1.el9_3"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"org.postgresql:postgresql","fixed_in":["42.5.1-aikido.2","42.6.0-aikido.3","42.5.1-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.org.postgresql:postgresql","fixed_in":["42.6.0-root.io.1","42.6.0-root.io.2","42.5.1-root.io.2","42.6.0-root.io.3","42.5.1-root.io.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"postgresql-jdbc","fixed_in":["42.2.25-150300.3.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"postgresql-jdbc","fixed_in":["42.2.25-150300.3.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"postgresql-jdbc","fixed_in":["42.2.25-150300.3.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7.1","package":"postgresql-jdbc","fixed_in":["42.2.25-150300.3.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"postgresql-jdbc","fixed_in":["9.4-3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"postgresql-jdbc","fixed_in":["9.4-3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP5","package":"postgresql-jdbc","fixed_in":["42.2.25-150400.3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"postgresql-jdbc","fixed_in":["42.2.25-150400.3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"postgresql-jdbc","fixed_in":["42.2.25-150400.3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"postgresql-jdbc","fixed_in":["42.2.25-150400.3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"postgresql-jdbc","fixed_in":["42.2.25-150400.3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 4.3","package":"postgresql-jdbc","fixed_in":["42.2.25-150400.3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 4.3","package":"postgresql-jdbc","fixed_in":["42.2.25-150400.3.12.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"postgresql-jdbc","fixed_in":["42.2.25-150400.3.12.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.postgresql:postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.2.28"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.postgresql:postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"42.3.0"},{"fixed":"42.3.9"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.postgresql:postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"42.4.0"},{"fixed":"42.4.4"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.postgresql:postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"42.5.0"},{"fixed":"42.5.5"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.postgresql:postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"42.6.0"},{"fixed":"42.6.1"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.postgresql:postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"42.7.0"},{"fixed":"42.7.2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"java-postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.6.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"java-postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.6.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"java-postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.6.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"java-postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.6.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"java-postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.6.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"java-postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.6.2-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.2.14-3.el8_9"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"postgresql-jdbc-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.2.14-3.el8_9"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.2.28-1.el9_3"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"postgresql-jdbc-driver","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"42.2.28"},{"introduced":"42.3.0"},{"fixed":"42.3.9"},{"introduced":"42.4.0"},{"fixed":"42.4.4"},{"introduced":"42.5.0"},{"fixed":"42.5.5"},{"introduced":"42.6.0"},{"fixed":"42.6.1"},{"introduced":"42.7.0"},{"fixed":"42.7.2"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.postgresql:postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"42.5.0"},{"fixed":"42.5.0-tuxcare.1"}]}],"versions":["42.5.0"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.postgresql:postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"42.2.16"},{"fixed":"42.2.16-tuxcare.1"}]}],"versions":["42.2.16"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.2.28-1.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"postgresql-jdbc-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.2.28-1.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.2.28-1.el9_3.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"postgresql-jdbc-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.2.28-1.el9_3.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"libpgjava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.5.5-0+deb12u1"}]}],"versions":["42.5.4-1"]},{"source":"osv","ecosystem":"Debian:13","package":"libpgjava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.7.2-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libpgjava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.7.2-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"libpgjava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.2.5-2+deb10u4"}]}],"versions":["42.2.5-2","42.2.5-2+deb10u1","42.2.5-2+deb10u2","42.2.5-2+deb10u3"]},{"source":"osv","ecosystem":"Debian:11","package":"libpgjava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.2.15-1+deb11u2"}]}],"versions":["42.2.15-1","42.2.15-1+deb11u1"],"bundled":3},{"source":"osv","ecosystem":"Maven","package":"org.postgresql:postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.2.28"}]}],"versions":["42.0.0","42.0.0.jre6","42.0.0.jre7","42.1.0","42.1.0.jre7","42.1.1","42.1.1.jre6","42.1.1.jre7","42.1.2","42.1.2.jre6","42.1.2.jre7","42.1.3","42.1.3.jre6","42.1.3.jre7","42.1.4","42.1.4.jre6","42.1.4.jre7","42.2.0","42.2.0.jre6","42.2.0.jre7","42.2.1","42.2.1.jre6","42.2.1.jre7","42.2.10","42.2.10.jre6","42.2.10.jre7","42.2.11","42.2.11.jre6","42.2.11.jre7","42.2.12","42.2.12.jre6","42.2.12.jre7","42.2.13","42.2.13.jre6","42.2.13.jre7","42.2.14","42.2.14.jre6","42.2.14.jre7","42.2.15","42.2.15.jre6","42.2.15.jre7","42.2.16","42.2.16.jre6","42.2.16.jre7","42.2.17","42.2.17.jre6","42.2.17.jre7","42.2.18","42.2.18.jre6","42.2.18.jre7","42.2.19","42.2.19.jre6","42.2.19.jre7","42.2.2","42.2.2.jre6","42.2.2.jre7","42.2.20","42.2.20.jre6","42.2.20.jre7","42.2.21","42.2.21.jre6","42.2.21.jre7","42.2.22","42.2.22.jre6","42.2.22.jre7","42.2.23","42.2.23.jre6","42.2.23.jre7","42.2.24","42.2.24.jre6","42.2.24.jre7","42.2.25","42.2.25.jre6","42.2.25.jre7","42.2.26","42.2.26.jre6","42.2.26.jre7","42.2.27","42.2.27.jre6","42.2.27.jre7","42.2.3","42.2.3.jre6","42.2.3.jre7","42.2.4","42.2.4.jre6","42.2.4.jre7","42.2.5","42.2.5.jre6","42.2.5.jre7","42.2.6","42.2.6.jre6","42.2.6.jre7","42.2.7","42.2.7.jre6","42.2.7.jre7","42.2.8","42.2.8.jre6","42.2.8.jre7","42.2.9","42.2.9.jre6","42.2.9.jre7","9.2-1002-jdbc4","9.2-1003-jdbc3","9.2-1003-jdbc4","9.2-1004-jdbc3","9.2-1004-jdbc4","9.2-1004-jdbc41","9.3-1100-jdbc3","9.3-1100-jdbc4","9.3-1100-jdbc41","9.3-1101-jdbc3","9.3-1101-jdbc4","9.3-1101-jdbc41","9.3-1102-jdbc3","9.3-1102-jdbc4","9.3-1102-jdbc41","9.3-1103-jdbc3","9.3-1103-jdbc4","9.3-1103-jdbc41","9.3-1104-jdbc4","9.3-1104-jdbc41","9.4-1200-jdbc4","9.4-1200-jdbc41","9.4-1201-jdbc4","9.4-1201-jdbc41","9.4-1202-jdbc4","9.4-1202-jdbc41","9.4-1202-jdbc42","9.4-1203-jdbc4","9.4-1203-jdbc41","9.4-1203-jdbc42","9.4-1204-jdbc4","9.4-1204-jdbc41","9.4-1204-jdbc42","9.4-1205-jdbc4","9.4-1205-jdbc41","9.4-1205-jdbc42","9.4-1206-jdbc4","9.4-1206-jdbc41","9.4-1206-jdbc42","9.4.1207","9.4.1207.jre6","9.4.1207.jre7","9.4.1208","9.4.1208.jre6","9.4.1208.jre7","9.4.1209","9.4.1209.jre6","9.4.1209.jre7","9.4.1210","9.4.1210.jre6","9.4.1210.jre7","9.4.1211","9.4.1211.jre6","9.4.1211.jre7","9.4.1212","9.4.1212.jre6","9.4.1212.jre7"]},{"source":"osv","ecosystem":"Maven","package":"org.postgresql:postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"42.3.0"},{"fixed":"42.3.9"}]}],"versions":["42.3.0","42.3.1","42.3.2","42.3.3","42.3.4","42.3.5","42.3.6","42.3.7","42.3.8"]},{"source":"osv","ecosystem":"Maven","package":"org.postgresql:postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"42.4.0"},{"fixed":"42.4.4"}]}],"versions":["42.4.0","42.4.1","42.4.2","42.4.3"]},{"source":"osv","ecosystem":"Maven","package":"org.postgresql:postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"42.5.0"},{"fixed":"42.5.5"}]}],"versions":["42.5.0","42.5.1","42.5.2","42.5.3","42.5.4"]},{"source":"osv","ecosystem":"Maven","package":"org.postgresql:postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"42.6.0"},{"fixed":"42.6.1"}]}],"versions":["42.6.0"]},{"source":"osv","ecosystem":"Maven","package":"org.postgresql:postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"42.7.0"},{"fixed":"42.7.2"}]}],"versions":["42.7.0","42.7.1"]},{"source":"osv","ecosystem":"Mageia:9","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.5.6-1.mga9"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.4.1-3.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.4.1-3.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.4.1-3.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.4.1-3.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP2","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.4.1-3.oe2203sp2"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.4.1-3.oe2203sp3"}]}]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.postgresql:postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.3.3.rhlw-00006"}]}],"versions":["42.0.0","42.0.0.jre6","42.0.0.jre7","42.1.0","42.1.0.jre7","42.1.1","42.1.1.jre6","42.1.1.jre7","42.1.2","42.1.2.jre6","42.1.2.jre7","42.1.3","42.1.3.jre6","42.1.3.jre7","42.1.4","42.1.4.jre6","42.1.4.jre7","42.2.0","42.2.0.jre6","42.2.0.jre7","42.2.1","42.2.1.jre6","42.2.1.jre7","42.2.10","42.2.10.jre6","42.2.10.jre7","42.2.11","42.2.11.jre6","42.2.11.jre7","42.2.12","42.2.12.jre6","42.2.12.jre7","42.2.13","42.2.13.jre6","42.2.13.jre7","42.2.14","42.2.14.jre6","42.2.14.jre7","42.2.15","42.2.15.jre6","42.2.15.jre7","42.2.16","42.2.16.jre6","42.2.16.jre7","42.2.17","42.2.17.jre6","42.2.17.jre7","42.2.18","42.2.18.jre6","42.2.18.jre7","42.2.19","42.2.19.jre6","42.2.19.jre7","42.2.2","42.2.2.jre6","42.2.2.jre7","42.2.20","42.2.20.jre6","42.2.20.jre7","42.2.21","42.2.21.jre6","42.2.21.jre7","42.2.22","42.2.22.jre6","42.2.22.jre7","42.2.23","42.2.23.jre6","42.2.23.jre7","42.2.24","42.2.24.jre6","42.2.24.jre7","42.2.25","42.2.25.jre6","42.2.25.jre7","42.2.26","42.2.26.jre6","42.2.26.jre7","42.2.27","42.2.27.jre6","42.2.27.jre7","42.2.28","42.2.28.jre7","42.2.29","42.2.29.jre7","42.2.3","42.2.3.jre6","42.2.3.jre7","42.2.4","42.2.4.jre6","42.2.4.jre7","42.2.5","42.2.5.jre6","42.2.5.jre7","42.2.6","42.2.6.jre6","42.2.6.jre7","42.2.7","42.2.7.jre6","42.2.7.jre7","42.2.8","42.2.8.jre6","42.2.8.jre7","42.2.9","42.2.9.jre6","42.2.9.jre7","42.3.0","42.3.1","42.3.2","42.3.3","9.2-1002-jdbc4","9.2-1003-jdbc3","9.2-1003-jdbc4","9.2-1004-jdbc3","9.2-1004-jdbc4","9.2-1004-jdbc41","9.3-1100-jdbc3","9.3-1100-jdbc4","9.3-1100-jdbc41","9.3-1101-jdbc3","9.3-1101-jdbc4","9.3-1101-jdbc41","9.3-1102-jdbc3","9.3-1102-jdbc4","9.3-1102-jdbc41","9.3-1103-jdbc3","9.3-1103-jdbc4","9.3-1103-jdbc41","9.3-1104-jdbc4","9.3-1104-jdbc41","9.4-1200-jdbc4","9.4-1200-jdbc41","9.4-1201-jdbc4","9.4-1201-jdbc41","9.4-1202-jdbc4","9.4-1202-jdbc41","9.4-1202-jdbc42","9.4-1203-jdbc4","9.4-1203-jdbc41","9.4-1203-jdbc42","9.4-1204-jdbc4","9.4-1204-jdbc41","9.4-1204-jdbc42","9.4-1205-jdbc4","9.4-1205-jdbc41","9.4-1205-jdbc42","9.4-1206-jdbc4","9.4-1206-jdbc41","9.4-1206-jdbc42","9.4.1207","9.4.1207.jre6","9.4.1207.jre7","9.4.1208","9.4.1208.jre6","9.4.1208.jre7","9.4.1209","9.4.1209.jre6","9.4.1209.jre7","9.4.1210","9.4.1210.jre6","9.4.1210.jre7","9.4.1211","9.4.1211.jre6","9.4.1211.jre7","9.4.1212","9.4.1212.jre6","9.4.1212.jre7"],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:42.2.14-3.el8_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"postgresql-jdbc-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:42.2.14-3.el8_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:42.2.28-1.el9_3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:42.2.28-1.el9_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.0::appstream","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:42.2.28-1.el9_0"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:42.2.3-5.el8_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"postgresql-jdbc-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:42.2.3-5.el8_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.2::appstream","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:42.2.3-5.el8_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.2::appstream","package":"postgresql-jdbc-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:42.2.3-5.el8_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.2::appstream","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:42.2.3-5.el8_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.2::appstream","package":"postgresql-jdbc-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:42.2.3-5.el8_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:42.2.14-5.el8_8"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"postgresql-jdbc-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:42.2.14-5.el8_8"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:42.2.3-7.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"postgresql-jdbc-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:42.2.3-7.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:42.2.3-7.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"postgresql-jdbc-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:42.2.3-7.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:42.2.3-7.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"postgresql-jdbc-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:42.2.3-7.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:42.2.3-5.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"postgresql-jdbc-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:42.2.3-5.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:42.2.3-5.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"postgresql-jdbc-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:42.2.3-5.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:42.2.3-5.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"postgresql-jdbc-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:42.2.3-5.el8_6"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:42.2.14-3.el8_9"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:42.2.28-1.el9_3"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"org.postgresql:postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.5.1-aikido.2"},{"fixed":"42.6.0-aikido.3"},{"fixed":"42.5.1-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.org.postgresql:postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.6.0-root.io.1"},{"fixed":"42.6.0-root.io.2"},{"fixed":"42.5.1-root.io.2"},{"fixed":"42.6.0-root.io.3"},{"fixed":"42.5.1-root.io.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.2.25-150300.3.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.2.25-150300.3.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.2.25-150300.3.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.2.25-150300.3.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4-3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4-3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP5","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.2.25-150400.3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.2.25-150400.3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.2.25-150400.3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.2.25-150400.3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.2.25-150400.3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.2.25-150400.3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.2.25-150400.3.12.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.2.25-150400.3.12.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"libpgjava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.2-1002-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libpgjava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.1212-1","9.4.1212-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libpgjava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["42.2.6-1","42.2.8-1","42.2.9-1","42.2.10-1","42.2.10-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libpgjava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["42.2.23-1","42.2.24-1","42.3.1-1","42.3.2-1","42.3.3-1"]}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"pgjdbc","product":"pgjdbc"},{"vendor":"postgresql","product":"postgresql_jdbc_driver"}],"references":[{"url":"https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-24rp-q3w6-vc56","tags":["x_transferred","Third Party Advisory","advisory","web","article","report"]},{"url":"https://www.enterprisedb.com/docs/security/assessments/cve-2024-1597/","tags":["x_transferred","Third Party Advisory","advisory","web","article"]},{"url":"https://www.enterprisedb.com/docs/jdbc_connector/latest/01_jdbc_rel_notes/","tags":["x_transferred","Release Notes","article","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TZQTSMESZD2RJ5XBPSXH3TIQVUW5DIUU/","tags":["x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://security.netapp.com/advisory/ntap-20240419-0008/","tags":["x_transferred","web","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2024/04/02/6","tags":["x_transferred","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/05/msg00007.html","tags":["x_transferred","web"]},{"url":"https://www.sonarsource.com/blog/double-dash-double-trouble-a-subtle-sql-injection-flaw/","tags":["web","article"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/12/msg00017.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-1597","tags":["web","advisory"]},{"url":"https://github.com/pgjdbc/pgjdbc/commit/06abfb78a627277a580d4df825f210e96a4e14ee","tags":["web","report"]},{"url":"https://github.com/pgjdbc/pgjdbc/commit/93b0fcb2711d9c1e3a2a03134369738a02a58b40","tags":["web","report"]},{"url":"https://github.com/advisories/GHSA-24rp-q3w6-vc56","tags":["advisory"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2024-1597","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:1435","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-1597","tags":["report"]},{"url":"https://bugzilla.redhat.com/2266523","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2024-1435.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:1436","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2024-1436.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2025-1762243790.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1781608329.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42198","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/1xxx/CVE-2024-1597.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-1597","tags":["advisory"]},{"url":"https://github.com/pgjdbc/pgjdbc","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2024-0120.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33051","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2024/04/02/6","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1237","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31197.json","tags":["advisory"]},{"url":"https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-r38f-c4h4-hqq2","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-31197","tags":["advisory"]},{"url":"https://github.com/pgjdbc/pgjdbc/commit/739e599d52ad80f8dcd6efedc6157859b1a9d637","tags":["fix"]},{"url":"https://github.com/advisories/GHSA-r38f-c4h4-hqq2","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/41xxx/CVE-2022-41946.json","tags":["advisory"]},{"url":"https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-562r-vg33-8x8h","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-41946","tags":["advisory"]},{"url":"https://github.com/pgjdbc/pgjdbc/commit/9008dc9aade6dbfe4efafcd6872ebc55f4699cf5","tags":["fix"]},{"url":"https://github.com/advisories/GHSA-562r-vg33-8x8h","tags":["advisory"]},{"url":"https://github.com/pgjdbc/pgjdbc/releases/tag/REL42.7.11","tags":["web"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42198.json","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:19098","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:22304","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:24348","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:25030","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:52928","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:52929","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:52930","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:52978","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:54532","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:59277","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:59278","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:66488","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:66545","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42198","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42198.json","tags":["advisory"]},{"url":"https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-98qh-xjc8-98pq","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-98qh-xjc8-98pq","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2266523","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1435.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-1597","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1436.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:1649","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1649.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:1999","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1999.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:2624","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2624.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:3313","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_3313.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:4375","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_4375.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:4402","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_4402.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2024:1435","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2024:1436","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240769-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1220644","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-1597","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240771-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240773-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-1597","tags":["report"]},{"url":"https://github.com/pgjdbc/pgjdbc/commit/1b1d6b53eca90409af0069d5327d4fdf8d40a255","tags":["report"]},{"url":"https://github.com/pgjdbc/pgjdbc/commit/475e3e2af3033c666fc1c0015159b35455118ae5","tags":["report"]},{"url":"https://github.com/pgjdbc/pgjdbc/commit/b9b3777671c8a5cc580e1985f61337d39d47c730","tags":["report"]},{"url":"https://github.com/pgjdbc/pgjdbc/commit/990d63f6be401ab40de5eb303a75924c9e71903c","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-1597","title":"pgjdbc SQL Injection via line comment generation","description":"pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE. Note this is not the default. In the default mode there is no vulnerability. A placeholder for a numeric value must be immediately preceded by a minus. There must be a second placeholder for a string value after the first placeholder; both must be on the same line. By constructing a matching string payload, the attacker can inject SQL to alter the query,bypassing the protections that parameterized queries bring against SQL Injection attacks. Versions before 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9, and 42.2.28 are affected.","status":"published","published":"2024-02-19T12:58:48.62Z","modified":"2025-11-03T21:52:29.022Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:34:18.259965Z"}],"euvd":[{"id":"EUVD-2024-0465","description":"pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE. Note this is not the default. In the default mode there is no vulnerability. A placeholder for a numeric value must be immediately preceded by a minus. There must be a second placeholder for a string value after the first placeholder; both must be on the same line. By constructing a matching string payload, the attacker can inject SQL to alter the query,bypassing the protections that parameterized queries bring against SQL Injection attacks. Versions before 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9, and 42.2.28 are affected.","status":"published","published":"2024-02-19T12:58:48Z","modified":"2025-11-03T21:52:29Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T19:49:30.775561Z"}],"ghsa":[{"id":"GHSA-24rp-q3w6-vc56","title":"org.postgresql:postgresql vulnerable to SQL Injection via line comment generation","description":"# Impact\nSQL injection is possible when using the non-default connection property `preferQueryMode=simple` in combination with application code that has a vulnerable SQL that negates a parameter value.\n\nThere is no vulnerability in the driver when using the default query mode. Users that do not override the query mode are not impacted.\n\n# Exploitation\n\nTo exploit this behavior the following conditions must be met:\n\n1. A placeholder for a numeric value must be immediately preceded by a minus (i.e. `-`)\n1. There must be a second placeholder for a string value after the first placeholder on the same line. \n1. Both parameters must be user controlled.\n\nThe prior behavior of the driver when operating in simple query mode would inline the negative value of the first parameter and cause the resulting line to be treated as a `--` SQL comment. That would extend to the beginning of the next parameter and cause the quoting of that parameter to be consumed by the comment line. If that string parameter includes a newline, the resulting text would appear unescaped in the resulting SQL.\n\nWhen operating in the default extended query mode this would not be an issue as the parameter values are sent separately to the server. Only in simple query mode the parameter values are inlined into the executed SQL causing this issue.\n\n# Example\n\n```java\nPreparedStatement stmt = conn.prepareStatement(\"SELECT -?, ?\");\nstmt.setInt(1, -1);\nstmt.setString(2, \"\\nWHERE false --\");\nResultSet rs = stmt.executeQuery();\n```\n\nThe resulting SQL when operating in simple query mode would be:\n\n```sql\nSELECT --1,'\nWHERE false --'\n```\n\nThe contents of the second parameter get injected into the command. Note how both the number of result columns and the WHERE clause of the command have changed. A more elaborate example could execute arbitrary other SQL commands.\n\n# Patch\nProblem will be patched upgrade to 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9, 42.2.28, 42.2.28.jre7\n\nThe patch fixes the inlining of parameters by forcing them all to be serialized as wrapped literals. The SQL in the prior example would be transformed into:\n\n```sql\nSELECT -('-1'::int4), ('\nWHERE false --')\n```\n\n# Workarounds\nDo not use the connection property`preferQueryMode=simple`. (*NOTE: If you do not explicitly specify a query mode then you are using the default of `extended` and are not impacted by this issue.*)","status":"published","published":"2024-02-21T23:33:43Z","modified":"2026-03-21T05:29:24Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:39:40.633038Z"}],"nvd":[{"id":"CVE-2024-1597","description":"pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE. Note this is not the default. In the default mode there is no vulnerability. A placeholder for a numeric value must be immediately preceded by a minus. There must be a second placeholder for a string value after the first placeholder; both must be on the same line. By constructing a matching string payload, the attacker can inject SQL to alter the query,bypassing the protections that parameterized queries bring against SQL Injection attacks. Versions before 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9, and 42.2.28 are affected.","status":"published","published":"2024-02-19T13:15:07.74Z","modified":"2026-06-17T07:04:36.577Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:09:37.655131Z"}],"osv":[{"id":"ALPINE-CVE-2024-1597","description":"pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE. Note this is not the default. In the default mode there is no vulnerability. A placeholder for a numeric value must be immediately preceded by a minus. There must be a second placeholder for a string value after the first placeholder; both must be on the same line. By constructing a matching string payload, the attacker can inject SQL to alter the query,bypassing the protections that parameterized queries bring against SQL Injection attacks. Versions before 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9, and 42.2.28 are affected.","status":"published","published":"2024-02-19T13:15:07.74Z","modified":"2026-11-03T06:32:59.650103411Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T07:16:09.603409Z"},{"id":"CVE-2024-1597","title":"pgjdbc SQL Injection via line comment generation","description":"pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE. Note this is not the default. In the default mode there is no vulnerability. A placeholder for a numeric value must be immediately preceded by a minus. There must be a second placeholder for a string value after the first placeholder; both must be on the same line. By constructing a matching string payload, the attacker can inject SQL to alter the query,bypassing the protections that parameterized queries bring against SQL Injection attacks. Versions before 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9, and 42.2.28 are affected.","status":"published","published":"2024-02-19T12:58:48.62Z","modified":"2026-10-28T10:41:05.940842255Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:44:37.917085Z"},{"id":"DEBIAN-CVE-2024-1597","description":"pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE. Note this is not the default. In the default mode there is no vulnerability. A placeholder for a numeric value must be immediately preceded by a minus. There must be a second placeholder for a string value after the first placeholder; both must be on the same line. By constructing a matching string payload, the attacker can inject SQL to alter the query,bypassing the protections that parameterized queries bring against SQL Injection attacks. Versions before 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9, and 42.2.28 are affected.","status":"published","published":"2024-02-19T13:15:07.74Z","modified":"2026-11-02T12:00:42.261528566Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:41.849198Z"},{"id":"GHSA-24rp-q3w6-vc56","title":"org.postgresql:postgresql vulnerable to SQL Injection via line comment generation","description":"# Impact\nSQL injection is possible when using the non-default connection property `preferQueryMode=simple` in combination with application code that has a vulnerable SQL that negates a parameter value.\n\nThere is no vulnerability in the driver when using the default query mode. Users that do not override the query mode are not impacted.\n\n# Exploitation\n\nTo exploit this behavior the following conditions must be met:\n\n1. A placeholder for a numeric value must be immediately preceded by a minus (i.e. `-`)\n1. There must be a second placeholder for a string value after the first placeholder on the same line. \n1. Both parameters must be user controlled.\n\nThe prior behavior of the driver when operating in simple query mode would inline the negative value of the first parameter and cause the resulting line to be treated as a `--` SQL comment. That would extend to the beginning of the next parameter and cause the quoting of that parameter to be consumed by the comment line. If that string parameter includes a newline, the resulting text would appear unescaped in the resulting SQL.\n\nWhen operating in the default extended query mode this would not be an issue as the parameter values are sent separately to the server. Only in simple query mode the parameter values are inlined into the executed SQL causing this issue.\n\n# Example\n\n```java\nPreparedStatement stmt = conn.prepareStatement(\"SELECT -?, ?\");\nstmt.setInt(1, -1);\nstmt.setString(2, \"\\nWHERE false --\");\nResultSet rs = stmt.executeQuery();\n```\n\nThe resulting SQL when operating in simple query mode would be:\n\n```sql\nSELECT --1,'\nWHERE false --'\n```\n\nThe contents of the second parameter get injected into the command. Note how both the number of result columns and the WHERE clause of the command have changed. A more elaborate example could execute arbitrary other SQL commands.\n\n# Patch\nProblem will be patched upgrade to 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9, 42.2.28, 42.2.28.jre7\n\nThe patch fixes the inlining of parameters by forcing them all to be serialized as wrapped literals. The SQL in the prior example would be transformed into:\n\n```sql\nSELECT -('-1'::int4), ('\nWHERE false --')\n```\n\n# Workarounds\nDo not use the connection property`preferQueryMode=simple`. (*NOTE: If you do not explicitly specify a query mode then you are using the default of `extended` and are not impacted by this issue.*)","status":"published","published":"2024-02-21T23:33:43Z","modified":"2026-09-10T03:50:05.363063642Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:46:33.956911Z"},{"id":"OESA-2024-1237","title":"postgresql-jdbc security update","description":"PostgreSQL JDBC Driver (PgJDBC for short) allows Java programs to connect to a PostgreSQL database using standard, database independent Java code. Is an open source JDBC driver written in Pure Java (Type 4), and communicates in the PostgreSQL native network protocol.\r\n\r\nSecurity Fix(es):\r\n\r\npgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE. Note this is not the default. In the default mode there is no vulnerability. A placeholder for a numeric value must be immediately preceded by a minus. There must be a second placeholder for a string value after the first placeholder; both must be on the same line. By constructing a matching string payload, the attacker can inject SQL to alter the query,bypassing the protections that parameterized queries bring against SQL Injection attacks. Versions before 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9, and 42.2.8 are affected.(CVE-2024-1597)","status":"published","published":"2024-03-01T11:06:41Z","modified":"2026-08-18T01:18:17.674564108Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"RHLW-2026-b44d1f7dac7a0d3d","title":"Lightwell Security Advisory: postgresql 42.3.3.rhlw-00006","description":"Red Hat Lightwell has released org.postgresql:postgresql 42.3.3.rhlw-00006 with backported fixes for CVE-2022-31197, CVE-2022-41946, CVE-2024-1597, and CVE-2026-42198.\n\nCVE-2022-31197: SQL Injection in ResultSet.refreshRow() with malicious column names in pgjdbc\n\nCVE-2022-41946: TemporaryFolder on unix-like systems does not limit access to created files in pgjdbc\n\nCVE-2024-1597: pgjdbc SQL Injection via line comment generation\n\nCVE-2026-42198: pgjdbc: Unbounded PBKDF2 iterations in SCRAM authentication allows CPU exhaustion DoS\n\nThis patched artifact is a drop-in replacement for org.postgresql:postgresql 42.3.3 from Maven Central.","status":"published","published":"2026-10-08T00:00:00Z","modified":"2026-10-27T04:13:04.315085632Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHSA-2024:1435","title":"Red Hat Security Advisory: postgresql-jdbc security update","status":"published","published":"2024-09-18T08:44:21Z","modified":"2026-08-05T10:18:22Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"RHSA-2024:1436","title":"Red Hat Security Advisory: postgresql-jdbc security update","status":"published","published":"2024-09-18T08:44:32Z","modified":"2026-08-05T10:18:23Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"RHSA-2024:1649","title":"Red Hat Security Advisory: postgresql-jdbc: security update","status":"published","published":"2024-09-18T08:44:51Z","modified":"2026-08-05T10:18:34Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"RHSA-2024:1999","title":"Red Hat Security Advisory: postgresql-jdbc security update","status":"published","published":"2024-09-18T08:46:33Z","modified":"2026-08-05T10:18:46Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:13.30378Z"},{"id":"RHSA-2024:2624","title":"Red Hat Security Advisory: postgresql-jdbc : Security Update","status":"published","published":"2024-09-18T08:45:32Z","modified":"2026-08-05T10:19:07Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:13.30378Z"},{"id":"RHSA-2024:3313","title":"Red Hat Security Advisory: postgresql-jdbc security update","status":"published","published":"2024-09-18T08:47:10Z","modified":"2026-08-05T10:19:35Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:13.30378Z"},{"id":"RHSA-2024:4375","title":"Red Hat Security Advisory: postgresql-jdbc security update","status":"published","published":"2024-09-18T08:48:28Z","modified":"2026-08-05T10:20:13Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:14.03234Z"},{"id":"RHSA-2024:4402","title":"Red Hat Security Advisory: postgresql-jdbc security update","status":"published","published":"2024-09-18T08:49:11Z","modified":"2026-08-05T10:20:15Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:14.03234Z"},{"id":"RLSA-2024:1436","title":"Important: postgresql-jdbc security update","description":"PostgreSQL is an advanced object-relational database management system. The postgresql-jdbc package includes the .jar files needed for Java programs to access a PostgreSQL database.\n\nSecurity Fix(es):\n\n* PostgreSQL JDBC Driver allows attacker to inject SQL if using PreferQueryMode=SIMPLE (CVE-2024-1597)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-05-10T14:32:42.380544Z","modified":"2025-10-09T06:18:54.725979Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:24.63379Z"},{"id":"UBUNTU-CVE-2024-1597","description":"pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE. Note this is not the default. In the default mode there is no vulnerability. A placeholder for a numeric value must be immediately preceded by a minus. There must be a second placeholder for a string value after the first placeholder; both must be on the same line. By constructing a matching string payload, the attacker can inject SQL to alter the query,bypassing the protections that parameterized queries bring against SQL Injection attacks. Versions before 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9, and 42.2.28 are affected.","status":"published","published":"2024-02-19T13:15:00Z","modified":"2026-11-04T20:02:18.550261884Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-06T14:22:48.685644Z"},{"id":"ALSA-2024:1435","title":"Important: postgresql-jdbc security update","description":"PostgreSQL is an advanced object-relational database management system. The postgresql-jdbc package includes the .jar files needed for Java programs to access a PostgreSQL database.\n\nSecurity Fix(es):\n\n* PostgreSQL JDBC Driver allows attacker to inject SQL if using PreferQueryMode=SIMPLE (CVE-2024-1597)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-03-20T00:00:00Z","modified":"2026-10-29T11:02:13.271113922Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"ALSA-2024:1436","title":"Important: postgresql-jdbc security update","description":"PostgreSQL is an advanced object-relational database management system. The postgresql-jdbc package includes the .jar files needed for Java programs to access a PostgreSQL database.\n\nSecurity Fix(es):\n\n* PostgreSQL JDBC Driver allows attacker to inject SQL if using PreferQueryMode=SIMPLE (CVE-2024-1597)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-03-20T00:00:00Z","modified":"2026-10-29T11:31:07.044635144Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"BIT-postgresql-jdbc-driver-2024-1597","title":"pgjdbc SQL Injection via line comment generation","description":"pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE. Note this is not the default. In the default mode there is no vulnerability. A placeholder for a numeric value must be immediately preceded by a minus. There must be a second placeholder for a string value after the first placeholder; both must be on the same line. By constructing a matching string payload, the attacker can inject SQL to alter the query,bypassing the protections that parameterized queries bring against SQL Injection attacks. Versions before 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9, and 42.2.28 are affected.","status":"published","published":"2024-03-12T08:33:54.711Z","modified":"2026-09-10T16:01:45.935939863Z","updated_at":"2026-11-02T15:28:34.724063Z"},{"id":"CLSA-2025-1754870602","title":"TuxCare security update for org.postgresql:postgresql (1 CVE)","description":"TuxCare rebuilt org.postgresql:postgresql to address 1 CVE. Fixed in 42.5.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:04Z","modified":"2026-10-15T09:45:03.069456649Z","updated_at":"2026-11-02T15:43:42.025438Z"},{"id":"CLSA-2025-1754870603","title":"TuxCare security update for org.postgresql:postgresql (3 CVEs)","description":"TuxCare rebuilt org.postgresql:postgresql to address 3 CVEs. Fixed in 42.2.16-tuxcare.1.","status":"published","published":"2026-08-04T14:52:04Z","modified":"2026-10-15T09:45:03.055656016Z","updated_at":"2026-11-02T15:43:42.025438Z"},{"id":"CLSA-2025-1762243790","title":"postgresql-jdbc: Fix of CVE-2024-1597","description":"- update to 42.2.28\n- CVE-2024-1597: fix SQL injection in PostgreSQL JDBC simple query mode","status":"published","published":"2025-11-04T08:09:56Z","modified":"2026-06-01T00:31:19.598573654Z","updated_at":"2026-11-02T15:43:42.427288Z"},{"id":"CLSA-2026-1781608329","title":"postgresql-jdbc: Fix of CVE-2026-42198","description":"- update to 42.2.28\n- CVE-2024-1597: fix SQL injection in PostgreSQL JDBC simple query mode","status":"published","published":"2026-06-16T11:12:24Z","modified":"2026-10-26T09:43:51.518417799Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"DLA-3812-1","title":"libpgjava - security update","status":"published","published":"2024-05-09T00:00:00Z","modified":"2026-03-09T01:21:03.015048Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"DLA-3995-1","title":"libpgjava - security update","status":"published","published":"2024-12-16T00:00:00Z","modified":"2026-03-09T01:21:29.724538Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"MGASA-2024-0120","title":"Updated postgresql-jdbc packages fix security vulnerability","description":"pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if\nusing PreferQueryMode=SIMPLE. Note this is not the default. In the\ndefault mode there is no vulnerability. A placeholder for a numeric\nvalue must be immediately preceded by a minus. There must be a second\nplaceholder for a string value after the first placeholder; both must be\non the same line. By constructing a matching string payload, the\nattacker can inject SQL to alter the query,bypassing the protections\nthat parameterized queries bring against SQL Injection attacks.\n(CVE-2024-1597)\n","status":"published","published":"2024-04-11T23:58:49Z","modified":"2026-04-16T04:42:54.284146116Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"openSUSE-SU-2024:13734-1","title":"postgresql-jdbc-42.7.2-1.1 on GA media","description":"These are all security issues fixed in the postgresql-jdbc-42.7.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:25:05.624061Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"RLSA-2024:1435","title":"Important: postgresql-jdbc security update","description":"PostgreSQL is an advanced object-relational database management system. The postgresql-jdbc package includes the .jar files needed for Java programs to access a PostgreSQL database.\n\nSecurity Fix(es):\n\n* PostgreSQL JDBC Driver allows attacker to inject SQL if using PreferQueryMode=SIMPLE (CVE-2024-1597)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-03-27T04:34:32.999941Z","modified":"2026-02-04T08:45:14.374529Z","updated_at":"2026-11-02T15:53:24.63379Z"},{"id":"ROOT-APP-MAVEN-CVE-2024-1597","title":"CVE-2024-1597 in org.postgresql:postgresql - Patched by Root","description":"Root has patched CVE-2024-1597 in the org.postgresql:postgresql package for Root:Maven. Multiple fixed versions available.","status":"published","published":"2026-09-17T12:21:50Z","modified":"2026-09-17T13:15:05.115090808Z","updated_at":"2026-11-02T15:53:27.066589Z"},{"id":"SUSE-SU-2024:0769-1","title":"Security update for postgresql-jdbc","description":"This update for postgresql-jdbc fixes the following issues:\n\n- CVE-2024-1597: Fixed SQL Injection via line comment generation (bsc#1220644).\n","status":"published","published":"2024-03-05T17:00:22Z","modified":"2026-02-04T03:55:20.506848Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:0771-1","title":"Security update for postgresql-jdbc","description":"This update for postgresql-jdbc fixes the following issues:\n\n- CVE-2024-1597: Fixed SQL Injection via line comment generation (bsc#1220644).\n","status":"published","published":"2024-03-05T17:01:05Z","modified":"2026-02-04T02:37:28.725447Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:0773-1","title":"Security update for postgresql-jdbc","description":"This update for postgresql-jdbc fixes the following issues:\n\n- CVE-2024-1597: Fixed SQL Injection via line comment generation (bsc#1220644).\n","status":"published","published":"2024-03-05T19:33:47Z","modified":"2026-02-04T02:38:37.074967Z","updated_at":"2026-11-02T15:53:54.239786Z"}]}}