search

tpolecat / doobie

Functional JDBC layer for Scala.
MIT License
2.13k stars 348 forks source link

[CVE-2024-1597] PostgresSQL version is shown as having a vulnerability to SQL Injection via line comment generation #2016

Closed mayman closed 3 months ago

mayman commented 3 months ago

Please update the version of Postgres to a version where this injection vulnerability has been fixed.

Vulnerability is shown to affect versions >= 42.7.0, < 42.7.2 and it was patched post 42.7.2.

https://cwe.mitre.org/data/definitions/89.html

jatcwang commented 3 months ago

Thanks will get this sorted for RC6. Meanwhile you should be able to bump it in your own build definition without issues.

jatcwang commented 3 months ago

Fixed in #2017