10

CVE-2024-1597: fedoraproject fedora SQL Injection

CVSS: 10.0v3.1CriticalModified
AliasesMGASA-2024-0120SUSE-SU-2024:0769-1SUSE-SU-2024:0771-1
Published 19-02-2024Last modified 03-11-2025
Open JSON

Vulnerability summary

CVE-2024-1597 is a critical (CVSS 10.0) SQL Injection vulnerability in fedoraproject fedora. EPSS estimates a 4.81% chance of exploitation in the next 30 days, higher than 91.8% of scored vulnerabilities.

Overall risk
70/100
0100
High · default modelHow is this calculated?
CVSS score
10.0/10
010
Critical · v3.1 (CVE.org)
EPSS score
4.81%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1 · Related 7
DLA-3995-1CGA-2JC3-3RHH-RC7VCGA-2Q5V-2CG8-99XHCGA-4M3Q-Q259-CF3QCGA-FJG5-9M84-P3V7CGA-QQM5-R7FC-Q5Q9

Timeline

  1. 19-02-2024
    PublishedVulnerability first disclosed.
  2. 03-11-2025
    Last modifiedVulnerability information updated.

Description

pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE. Note this is not the default. In the default mode there is no vulnerability. A placeholder for a numeric value must be immediately preceded by a minus. There must be a second placeholder for a string value after the first placeholder; both must be on the same line. By constructing a matching string payload, the attacker can inject SQL to alter the query,bypassing the protections that parameterized queries bring against SQL Injection attacks. Versions before 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9, and 42.2.28 are affected.

CVSS metrics

8 scores · 8 sources · 1 version

EPSS trend

Probability

4.81%

Chance of exploitation in the next 30 days

Percentile

92%

Versus all other CVEs

30-day change

0.00 pp

From 4.81% on 19-09-2026

19-09-202619-10-2026
EPSS score
4.81%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard87 products
  • dependency-track< 4.10.1-r1
  • dependency-track-bundled< 4.10.1-r1
  • keycloak< 23.0.7-r0
  • mariadb-10.11< 10.11.8-r2
  • mariadb-10.11-backup< 10.11.8-r2
Wolfi86 products
  • dependency-track< 4.10.1-r1
  • dependency-track-bundled< 4.10.1-r1
  • keycloak< 23.0.7-r0
  • mariadb-10.11< 10.11.8-r2
  • mariadb-10.11-backup< 10.11.8-r2
Suse13 products
  • postgresql-jdbc&distro=SUSE Enterprise Storage 7.1< 42.2.25-150300.3.14.1
  • postgresql-jdbc&distro=SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS< 42.2.25-150300.3.14.1
  • postgresql-jdbc&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS< 42.2.25-150400.3.12.1
  • postgresql-jdbc&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS< 42.2.25-150400.3.12.1
  • postgresql-jdbc&distro=SUSE Linux Enterprise Module for Server Applications 15 SP5< 42.2.25-150400.3.12.1
Redhat2 products
  • postgresql-jdbc< 0:42.2.14-3.el8_9 | < 0:42.2.28-1.el9_3 | < 0:42.2.28-1.el9_2 | < 0:42.2.28-1.el9_0 | < 0:42.2.3-5.el8_2 | < 0:42.2.14-5.el8_8 | < 0:42.2.3-7.el8_4 | < 0:42.2.3-5.el8_6
  • postgresql-jdbc-javadoc< 0:42.2.14-3.el8_9 | < 0:42.2.3-5.el8_2 | < 0:42.2.14-5.el8_8 | < 0:42.2.3-7.el8_4 | < 0:42.2.3-5.el8_6
Debian1 product
  • libpgjava< 42.5.5-0+deb12u1 | < 42.7.2-1 | < 42.2.5-2+deb10u4
Fedoraproject1 product
Mageia1 product
  • postgresql-jdbc< 42.5.6-1.mga9
Opensuse1 product
  • postgresql-jdbc&distro=openSUSE Leap 15.5< 42.2.25-150400.3.12.1
Org.postgresql1 product
  • postgresql< 42.2.28 | ≥ 42.7.0, < 42.7.2 | ≥ 42.6.0, < 42.6.1 | ≥ 42.5.0, < 42.5.5 | ≥ 42.4.0, < 42.4.4 | ≥ 42.3.0, < 42.3.9 | < 42.2.8
Pgjdbc1 product
  • pgjdbc< 42.7.2 | < 42.6.1 | < 42.5.5 | < 42.4.4 | < 42.3.9 | < 42.2.28
Postgresql1 product
  • postgresql_jdbc_driver< 42.2.28 | ≥ 42.3.0, < 42.3.9 | ≥ 42.4.0, < 42.4.4 | ≥ 42.5.0, < 42.5.5 | ≥ 42.6.0, < 42.6.1 | ≥ 42.7.0, < 42.7.2
Ubuntu1 product
  • libpgjavaAll versions (No fix recorded)

12 vendors · 196 products

References

52 links
Show all 52 references