Skip to content
OpenAdvisories
High ALSA-2024:1435 1 CVE

Important: postgresql-jdbc security update

Published Mar 20, 2024 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

PostgreSQL is an advanced object-relational database management system. The postgresql-jdbc package includes the .jar files needed for Java programs to access a PostgreSQL database.

Security Fix(es):

* PostgreSQL JDBC Driver allows attacker to inject SQL if using PreferQueryMode=SIMPLE (CVE-2024-1597)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 2

ReleasePackageFixed in
AlmaLinux · 8 postgresql-jdbc 42.2.14-3.el8_9
AlmaLinux · 8 postgresql-jdbc-javadoc 42.2.14-3.el8_9

Vulnerabilities 1

  • Critical 10.0
    CVE-2024-1597

    pgjdbc SQL Injection via line comment generation

    pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE. Note this is not the default. In the default mode there is no vulnerability. A placeholder for a numeric value must be immediately preceded by a minus. There mu…

    pgjdbc pgjdbc trino trino-plugin-opensearch Debian Ubuntu Alpine Wolfi Maven

References

  • report
    https://access.redhat.com/security/cve/CVE-2024-1597
  • report
    https://bugzilla.redhat.com/2266523
  • advisory
    https://errata.almalinux.org/8/ALSA-2024-1435.html