SQL Injection Vulnerability in pgx Prior to v4.18.2

CVE-2024-27289

What is CVE-2024-27289?

The pgx PostgreSQL driver and toolkit for Go is prone to a SQL injection vulnerability under specific conditions. This flaw exists when the non-default simple protocol is employed, and a numeric placeholder is preceded directly by a minus sign. Additionally, a string placeholder following it on the same line, both influenced by user input, creates an exploitable situation. The issue can be mitigated by upgrading to version 4.18.2, where the vulnerability is resolved, or by avoiding the use of the simple protocol or the placement of a minus sign before a numeric placeholder.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References