Skip to content
OpenAdvisories
Critical RHSA-2024:4402 1 CVE

Red Hat Security Advisory: postgresql-jdbc security update

Published Sep 18, 2024 · Updated Aug 5, 2026

Ecosystem: Red Hat

Fixed packages 6

ReleasePackageFixed in
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream postgresql-jdbc 0:42.2.3-5.el8_6
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream postgresql-jdbc-javadoc 0:42.2.3-5.el8_6
Red Hat · RHEL 8.6 E4S rhel_e4s:8.6::appstream postgresql-jdbc 0:42.2.3-5.el8_6
Red Hat · RHEL 8.6 E4S rhel_e4s:8.6::appstream postgresql-jdbc-javadoc 0:42.2.3-5.el8_6
Red Hat · RHEL 8.6 TUS rhel_tus:8.6::appstream postgresql-jdbc 0:42.2.3-5.el8_6
Red Hat · RHEL 8.6 TUS rhel_tus:8.6::appstream postgresql-jdbc-javadoc 0:42.2.3-5.el8_6

Vulnerabilities 1

  • Critical 10.0
    CVE-2024-1597

    pgjdbc SQL Injection via line comment generation

    pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE. Note this is not the default. In the default mode there is no vulnerability. A placeholder for a numeric value must be immediately preceded by a minus. There mu…

    pgjdbc pgjdbc trino trino-plugin-opensearch Debian Ubuntu Alpine Wolfi Maven

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2266523
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_4402.json
  • report
    https://access.redhat.com/security/cve/CVE-2024-1597
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2024-1597
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2024-1597
  • article
    https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-24rp-q3w6-vc56
  • article
    https://www.enterprisedb.com/docs/jdbc_connector/latest/01_jdbc_rel_notes/
  • article
    https://www.enterprisedb.com/docs/security/assessments/cve-2024-1597/