GHSA-7jwh-3vrq-q3m8: 
vulnerability analysis and mitigation

SQL injection vulnerability (GHSA-7jwh-3vrq-q3m8) was discovered in pgx, a PostgreSQL driver and toolkit for Go. The vulnerability was disclosed on March 4, 2024, affecting versions prior to v4.18.2 and v5.5.4. The issue exists in the protocol message handling where messages exceeding 4GB in size could lead to SQL injection attacks (GitHub Advisory).

The vulnerability stems from an integer overflow in the calculated message size when handling large protocol messages. If an attacker can cause a single query or bind message to exceed 4GB in size, the integer overflow would result in the large message being split into multiple messages under the attacker's control. The PostgreSQL server normally rejects messages greater than ~1GB, but messages larger than 4GB could wrap the 32-bit integer message size, allowing for message injection (PGX Commit).

If successfully exploited, this vulnerability allows attackers to perform SQL injection attacks by manipulating protocol messages. The attacker could potentially execute arbitrary SQL commands by splitting a large malicious message into multiple controlled messages, bypassing normal input validation (GitHub Advisory).

The vulnerability requires an attacker to be able to send protocol messages exceeding 4GB in size to the PostgreSQL server. While this is a significant constraint, the potential for SQL injection makes this a serious security concern. The vulnerability has been assigned a CVSS v3.1 base score of 9.8 CRITICAL (NVD).

The vulnerability has been patched in versions v4.18.2 and v5.5.4 of pgx. As a workaround, users should reject user input large enough to cause a single query or bind message to exceed 4GB in size. The fix involves implementing proper size checks and preventing message size integer overflow (GitHub Advisory).