search

golang / vulndb

[mirror] The Go Vulnerability Database
Other
555 stars 54 forks source link

x/vulndb: potential Go vuln in github.com/jackc/pgx/v5: GHSA-fqpg-rq76-99pq #2976

Closed GoVulnBot closed 1 week ago

GoVulnBot commented 2 weeks ago

Advisory GHSA-fqpg-rq76-99pq references a vulnerability in the following Go modules:

Module
github.com/jackc/pgx
github.com/jackc/pgx/v4
github.com/jackc/pgx/v5

Description: Pipeline can panic when PgConn is busy or closed.

References:

Cross references:

See doc/triage.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/jackc/pgx
      vulnerable_at: 3.6.2+incompatible
    - module: github.com/jackc/pgx/v4
      vulnerable_at: 4.18.3
    - module: github.com/jackc/pgx/v5
      versions:
        - fixed: 5.5.2
      vulnerable_at: 5.5.1
summary: Panic in Pipeline when PgConn is busy or closed in github.com/jackc/pgx
ghsas:
    - GHSA-fqpg-rq76-99pq
references:
    - advisory: https://github.com/advisories/GHSA-fqpg-rq76-99pq
    - fix: https://github.com/jackc/pgx/commit/dfd198003a03dbb96e4607b0d3a0bb9a7398ccb7
source:
    id: GHSA-fqpg-rq76-99pq
    created: 2024-07-05T21:01:13.951638683Z
review_status: UNREVIEWED
tatianab commented 1 week ago

GHSA for https://github.com/golang/vulndb/issues/2567

gopherbot commented 1 week ago

Change https://go.dev/cl/597156 mentions this issue: data/reports: update 2 reports