Arbitrary SQL injection vulnerability in Npgsql 8.0.2 and earlier
CVE-2024-32655
What is CVE-2024-32655?
A vulnerability in Npgsql, the .NET data provider for PostgreSQL, allows for the injection of arbitrary SQL commands due to an overflow issue in the WriteBind() method. The flaws arise when parameter lengths exceed the limit of the int type, leading to inadequate message sizes when packets are transmitted over the network. This exploitation can enable an attacker to send malicious PostgreSQL protocol messages, resulting in unauthorized SQL statement execution. The vulnerability has been addressed in versions 4.0.14, 4.1.13, 5.0.18, 6.0.11, 7.0.7, and 8.0.3.
Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.
Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.
Affected Version(s)
npgsql >= 4.0.0, < 4.0.14 < 4.0.0, 4.0.14
npgsql >= 4.1.0, < 4.1.13 < 4.1.0, 4.1.13
npgsql >= 5.0.0, < 5.0.18 < 5.0.0, 5.0.18