[{"vendor":"jackc","product":"pgx","defaultStatus":"unknown","cpes":["cpe:2.3:a:jackc:pgx:*:*:*:*:*:*:*:*"],"versions":[{"version":"0","lessThan":"4.18.2","versionType":"custom","status":"affected"}]}]

{"timestamp":"2024-07-24T14:13:55.313789Z","id":"CVE-2024-27289","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}

[{"vendor":"jackc","product":"pgx","versions":[{"version":"< 4.18.2","status":"affected"}]}]

OR
          *cpe:2.3:a:pgx_project:pgx:*:*:*:*:*:go:*:* versions up to (excluding) 4.18.2

OR
          *cpe:2.3:a:jackc:pgx:*:*:*:*:*:go:*:* versions up to (excluding) 4.18.2

OR
          *cpe:2.3:a:sgx_project:sgx:*:*:*:*:*:go:*:* versions up to (excluding) 4.18.2

OR
          *cpe:2.3:a:pgx_project:pgx:*:*:*:*:*:go:*:* versions up to (excluding) 4.18.2

OR
          *cpe:2.3:a:sgx_project:sgx:*:*:*:*:*:go:*:* versions up to (excluding) 4.18.2

CVE: https://github.com/jackc/pgx/commit/f94eb0e2f96782042c96801b5ac448f44f0a81df Types: Patch

CVE: https://github.com/jackc/pgx/security/advisories/GHSA-m7wr-2xf7-cm9p Types: Vendor Advisory

CVE: https://www.sonarsource.com/blog/double-dash-double-trouble-a-subtle-sql-injection-flaw/ Types: Third Party Advisory

GitHub, Inc.: https://github.com/jackc/pgx/commit/f94eb0e2f96782042c96801b5ac448f44f0a81df Types: Patch

GitHub, Inc.: https://github.com/jackc/pgx/security/advisories/GHSA-m7wr-2xf7-cm9p Types: Vendor Advisory

https://www.sonarsource.com/blog/double-dash-double-trouble-a-subtle-sql-injection-flaw/

https://github.com/jackc/pgx/commit/f94eb0e2f96782042c96801b5ac448f44f0a81df

https://github.com/jackc/pgx/security/advisories/GHSA-m7wr-2xf7-cm9p

pgx is a PostgreSQL driver and toolkit for Go. Prior to version 4.18.2, SQL injection can occur when all of the following conditions are met: the non-default simple protocol is used; a placeholder for a numeric value must be immediately preceded by a minus; there must be a second placeholder for a string value after the first placeholder; both must be on the same line; and both parameter values must be user-controlled. The problem is resolved in v4.18.2. As a workaround, do not use the simple protocol or do not place a minus directly before a placeholder.

GitHub, Inc. AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

GitHub, Inc. CWE-89

GitHub, Inc. https://github.com/jackc/pgx/commit/f94eb0e2f96782042c96801b5ac448f44f0a81df [No types assigned]

GitHub, Inc. https://github.com/jackc/pgx/security/advisories/GHSA-m7wr-2xf7-cm9p [No types assigned]