CVE-2024-1597: 
PostgreSQL Analisi e mitigazione delle vulnerabilità

A critical SQL injection vulnerability (CVE-2024-1597) was discovered in the PostgreSQL JDBC Driver (pgjdbc) affecting versions before 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9, and 42.2.28. The vulnerability exists when using the non-default connection property PreferQueryMode=SIMPLE, while the default mode remains unaffected (GitHub Advisory, NVD).

The vulnerability occurs when specific conditions are met: a placeholder for a numeric value must be immediately preceded by a minus sign, and there must be a second placeholder for a string value after the first placeholder on the same line. When operating in simple query mode, the driver would inline the negative value of the first parameter, causing the resulting line to be treated as a SQL comment (--). This behavior extends to the beginning of the next parameter and causes the quoting of that parameter to be consumed by the comment line. The vulnerability has received a CVSS v3.1 base score of 9.8-10.0 CRITICAL (GitHub Advisory, PostgreSQL Advisory).

Successful exploitation of this vulnerability could allow an attacker to bypass SQL injection protections, potentially leading to unauthorized data access, modification of data, or denial of service. The attacker can construct a matching string payload to alter the query, effectively bypassing the protections that parameterized queries typically provide against SQL injection attacks (NetApp Advisory, GitHub Advisory).

The primary mitigation is to upgrade to the fixed versions: 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9, or 42.2.28. For users who cannot immediately upgrade, the recommended workaround is to avoid using the connection property PreferQueryMode=SIMPLE, as the vulnerability does not affect the default query mode. The patch fixes the issue by forcing all parameters to be serialized as wrapped literals (GitHub Advisory, Enterprise DB).

Various organizations have responded to this vulnerability. Atlassian noted that while the vulnerability is critical in their Confluence dependency, their application's implementation presents a lower assessed risk. NetApp has conducted a comprehensive review of their product line to identify affected systems. Multiple Linux distributions, including Debian and Fedora, have released security updates to address this vulnerability (Debian LTS, Fedora Update).