References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

Change History

https://github.com/jackc/pgx/commit/f94eb0e2f96782042c96801b5ac448f44f0a81df

https://github.com/jackc/pgx/security/advisories/GHSA-m7wr-2xf7-cm9p

pgx is a PostgreSQL driver and toolkit for Go. Prior to version 4.18.2, SQL injection can occur when all of the following conditions are met: the non-default simple protocol is used; a placeholder for a numeric value must be immediately preceded by a minus; there must be a second placeholder for a string value after the first placeholder; both must be on the same line; and both parameter values must be user-controlled. The problem is resolved in v4.18.2. As a workaround, do not use the simple pr

GitHub, Inc. AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

GitHub, Inc. CWE-89

GitHub, Inc. https://github.com/jackc/pgx/commit/f94eb0e2f96782042c96801b5ac448f44f0a81df [No types assigned]

GitHub, Inc. https://github.com/jackc/pgx/security/advisories/GHSA-m7wr-2xf7-cm9p [No types assigned]