Skip to content
OpenAdvisories
Critical RHSA-2024:3313 1 CVE

Red Hat Security Advisory: postgresql-jdbc security update

Published Sep 18, 2024 · Updated Aug 5, 2026

Ecosystem: Red Hat

Fixed packages 2

ReleasePackageFixed in
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream postgresql-jdbc 0:42.2.14-5.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream postgresql-jdbc-javadoc 0:42.2.14-5.el8_8

Vulnerabilities 1

  • Critical 10.0
    CVE-2024-1597

    pgjdbc SQL Injection via line comment generation

    pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE. Note this is not the default. In the default mode there is no vulnerability. A placeholder for a numeric value must be immediately preceded by a minus. There mu…

    pgjdbc pgjdbc trino trino-plugin-opensearch Debian Ubuntu Alpine Wolfi Maven

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2266523
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_3313.json
  • report
    https://access.redhat.com/security/cve/CVE-2024-1597
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2024-1597
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2024-1597
  • article
    https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-24rp-q3w6-vc56
  • article
    https://www.enterprisedb.com/docs/jdbc_connector/latest/01_jdbc_rel_notes/
  • article
    https://www.enterprisedb.com/docs/security/assessments/cve-2024-1597/