Skip to content
OpenAdvisories
Critical · 10.0 CVE-2024-1597 BIT-postgresql-jdbc-driver-2024-1597EUVD-2024-0465GHSA-24rp-q3w6-vc56

pgjdbc SQL Injection via line comment generation

Published Feb 19, 2024 · Updated Nov 3, 2025 · Assigned by PostgreSQL

Vendor: pgjdbc Product: pgjdbc Package: dependency-track Package: dependency-track-bundled Package: java-postgresql-jdbc Package: libpgjava Package: libpgjava Package: mariadb-10.11 Package: mariadb-10.11-backup Package: mariadb-10.11-bench Package: mariadb-10.11-client Package: mariadb-10.11-dev Package: mariadb-10.11-doc Package: mariadb-10.11-embedded Package: mariadb-10.11-oci-entrypoint Package: mariadb-10.6 Package: mariadb-10.6-backup Package: mariadb-10.6-bench Package: mariadb-10.6-dev Package: mariadb-10.6-doc Package: mariadb-10.6-embedded Package: mariadb-10.6-oci-entrypoint Package: mariadb-10.6-test Package: mariadb-11.2 Package: mariadb-11.2-backup Package: mariadb-11.2-bench Package: mariadb-11.2-client Package: mariadb-11.2-dev Package: mariadb-11.2-doc Package: mariadb-11.2-embedded Package: mariadb-11.2-oci-entrypoint Package: org.postgresql:postgresql Package: trino Package: trino-config Package: trino-oci-entrypoint Package: trino-plugin-ai-functions Package: trino-plugin-bigquery Package: trino-plugin-blackhole Package: trino-plugin-cassandra Package: trino-plugin-clickhouse Package: trino-plugin-delta-lake Package: trino-plugin-druid Package: trino-plugin-duckdb Package: trino-plugin-elasticsearch Package: trino-plugin-exasol Package: trino-plugin-exchange-filesystem Package: trino-plugin-exchange-hdfs Package: trino-plugin-faker Package: trino-plugin-functions-python Package: trino-plugin-geospatial Package: trino-plugin-google-sheets Package: trino-plugin-hive Package: trino-plugin-http-event-listener Package: trino-plugin-http-server-event-listener Package: trino-plugin-hudi Package: trino-plugin-iceberg Package: trino-plugin-ignite Package: trino-plugin-jmx Package: trino-plugin-kafka Package: trino-plugin-kafka-event-listener Package: trino-plugin-lakehouse Package: trino-plugin-ldap-group-provider Package: trino-plugin-loki Package: trino-plugin-mariadb Package: trino-plugin-memory Package: trino-plugin-ml Package: trino-plugin-mongodb Package: trino-plugin-mysql Package: trino-plugin-mysql-event-listener Package: trino-plugin-opa Package: trino-plugin-openlineage Package: trino-plugin-opensearch Package: trino-plugin-oracle Package: trino-plugin-password-authenticators Package: trino-plugin-pinot Package: trino-plugin-postgresql Package: trino-plugin-prometheus Package: trino-plugin-ranger Package: trino-plugin-redis Package: trino-plugin-redshift Package: trino-plugin-resource-group-managers Package: trino-plugin-session-property-managers Package: trino-plugin-singlestore Package: trino-plugin-snowflake Package: trino-plugin-spooling-filesystem Package: trino-plugin-sqlserver Package: trino-plugin-teradata-functions Package: trino-plugin-thrift Package: trino-plugin-tpcds Package: trino-plugin-tpch Package: trino-plugin-vertica Ecosystem: Alpine Ecosystem: Debian Ecosystem: Maven Ecosystem: Ubuntu Ecosystem: Wolfi

Description

pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE. Note this is not the default. In the default mode there is no vulnerability. A placeholder for a numeric value must be immediately preceded by a minus. There must be a second placeholder for a string value after the first placeholder; both must be on the same line. By constructing a matching string payload, the attacker can inject SQL to alter the query,bypassing the protections that parameterized queries bring against SQL Injection attacks. Versions before 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9, and 42.2.28 are affected.

Affected products

VendorProductAffectedFixed
pgjdbc pgjdbc < 42.7.2, < 42.6.1, < 42.5.5, < 42.4.4, < 42.3.9, < 42.2.28 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 libpgjava 42.7.2-1 —
Debian 13 libpgjava 42.7.2-1 —
Debian 12 libpgjava 42.5.5-0+deb12u1 —
Debian 11 libpgjava 42.2.15-1+deb11u2 DLA-3995-1
Debian 10 libpgjava 42.2.5-2+deb10u4 DLA-3812-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 22.04 LTS libpgjava No fix yet —
Ubuntu 14.04 LTS libpgjava No fix yet —
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 20.04 LTS libpgjava No fix yet —
Ubuntu Pro 18.04 LTS libpgjava No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 9 postgresql-jdbc 42.2.28-1.el9_3 RHSA-2024:1436
RHEL 8 postgresql-jdbc +1 42.2.14-3.el8_9 RHSA-2024:1435
Show 12 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 9.2 EUS postgresql-jdbc 42.2.28-1.el9_2 RHSA-2024:1649
RHEL 9.0 EUS postgresql-jdbc 42.2.28-1.el9_0 RHSA-2024:1999
RHEL 8.8 EUS postgresql-jdbc +1 42.2.14-5.el8_8 RHSA-2024:3313
RHEL 8.6 TUS postgresql-jdbc +1 42.2.3-5.el8_6 RHSA-2024:4402
RHEL 8.6 E4S postgresql-jdbc +1 42.2.3-5.el8_6 RHSA-2024:4402
RHEL 8.6 AUS postgresql-jdbc +1 42.2.3-5.el8_6 RHSA-2024:4402
RHEL 8.4 TUS postgresql-jdbc +1 42.2.3-7.el8_4 RHSA-2024:4375
RHEL 8.4 E4S postgresql-jdbc +1 42.2.3-7.el8_4 RHSA-2024:4375
RHEL 8.4 AUS postgresql-jdbc +1 42.2.3-7.el8_4 RHSA-2024:4375
RHEL 8.2 TUS postgresql-jdbc +1 42.2.3-5.el8_2 RHSA-2024:2624
RHEL 8.2 E4S postgresql-jdbc +1 42.2.3-5.el8_2 RHSA-2024:2624
RHEL 8.2 AUS postgresql-jdbc +1 42.2.3-5.el8_2 RHSA-2024:2624

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 9 postgresql-jdbc 42.2.28-1.el9_3 ALSA-2024:1436
AlmaLinux 8 postgresql-jdbc +1 42.2.14-3.el8_9 ALSA-2024:1435

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 9 postgresql-jdbc 42.2.28-1.el9_3 RLSA-2024:1436
Rocky Linux 8 postgresql-jdbc 42.2.14-3.el8_9 RLSA-2024:1435

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP5 postgresql-jdbc 42.2.25-150400.3.12.1 SUSE-SU-2024:0773-1
SLES 15 SP4 postgresql-jdbc 42.2.25-150400.3.12.1 SUSE-SU-2024:0773-1
SLES 15 SP3 postgresql-jdbc 42.2.25-150300.3.14.1 SUSE-SU-2024:0769-1
SLES 12 SP5 postgresql-jdbc 9.4-3.12.1 SUSE-SU-2024:0771-1
Show 8 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 15 SP4 postgresql-jdbc 42.2.25-150400.3.12.1 SUSE-SU-2024:0773-1
SLES for SAP 15 SP3 postgresql-jdbc 42.2.25-150300.3.14.1 SUSE-SU-2024:0769-1
SLES for SAP 12 SP5 postgresql-jdbc 9.4-3.12.1 SUSE-SU-2024:0771-1
SLE HPC 15 SP4 postgresql-jdbc 42.2.25-150400.3.12.1 SUSE-SU-2024:0773-1
SLE HPC 15 SP3 postgresql-jdbc 42.2.25-150300.3.14.1 SUSE-SU-2024:0769-1
SUSE Manager Server 4.3 postgresql-jdbc 42.2.25-150400.3.12.1 SUSE-SU-2024:0773-1
SUSE Manager Proxy 4.3 postgresql-jdbc 42.2.25-150400.3.12.1 SUSE-SU-2024:0773-1
SUSE Enterprise Storage 7.1 postgresql-jdbc 42.2.25-150300.3.14.1 SUSE-SU-2024:0769-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Leap 15.5 postgresql-jdbc 42.2.25-150400.3.12.1 SUSE-SU-2024:0773-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 java-postgresql-jdbc 42.6.2-r0 —
Alpine v3.23 java-postgresql-jdbc 42.6.2-r0 —
Alpine v3.22 java-postgresql-jdbc 42.6.2-r0 —
Alpine v3.21 java-postgresql-jdbc 42.6.2-r0 —
Alpine v3.20 java-postgresql-jdbc 42.6.2-r0 —
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Alpine v3.19 java-postgresql-jdbc 42.6.2-r0 —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 9 postgresql-jdbc 42.2.28-1.el9_3 ELSA-2024-1436
Oracle Linux 8 postgresql-jdbc +1 42.2.14-3.el8_9 ELSA-2024-1435

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling dependency-track +1 4.10.1-r1 —
Wolfi rolling mariadb-10.11 +7 10.11.8-r2 —
Wolfi rolling mariadb-10.6 +7 10.6.17-r0 —
Wolfi rolling mariadb-11.2 +7 11.2.3-r2 —
Wolfi rolling trino +58 439-r2 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.postgresql:postgresql < 42.2.28 42.2.28 GHSA-24rp-q3w6-vc56
Maven org.postgresql:postgresql >= 42.3.0, < 42.3.9 42.3.9 GHSA-24rp-q3w6-vc56
Maven org.postgresql:postgresql >= 42.4.0, < 42.4.4 42.4.4 GHSA-24rp-q3w6-vc56
Maven org.postgresql:postgresql >= 42.5.0, < 42.5.5 42.5.5 GHSA-24rp-q3w6-vc56
Maven org.postgresql:postgresql >= 42.6.0, < 42.6.1 42.6.1 GHSA-24rp-q3w6-vc56
Maven org.postgresql:postgresql >= 42.7.0, < 42.7.2 42.7.2 GHSA-24rp-q3w6-vc56

Advisories 24

References