pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE. Note this is not the default. In the default mode there is no vulnerability. A placeholder for a numeric value must be immediately preceded by a minus. There must be a second placeholder for a string value after the first placeholder; both must be on the same line. By constructing a matching string payload, the attacker can inject SQL to alter the query,bypassing the protections that parameterized queries bring against SQL Injection attacks. Versions before 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9, and 42.2.28 are affected.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:4402 advisory.

    PostgreSQL is an advanced object-relational database management system. The postgresql-jdbc package     includes the .jar files needed for Java programs to access a PostgreSQL database.

    Security Fix(es):

    * pgjdbc: PostgreSQL JDBC Driver allows attacker to inject SQL if using PreferQueryMode=SIMPLE     (CVE-2024-1597)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:4375 advisory.

    PostgreSQL is an advanced object-relational database management system. The postgresql-jdbc package     includes the .jar files needed for Java programs to access a PostgreSQL database.

    Security Fix(es):

    * pgjdbc: PostgreSQL JDBC Driver allows attacker to inject SQL if using PreferQueryMode=SIMPLE     (CVE-2024-1597)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - pgjdbc: PostgreSQL JDBC Driver allows attacker to inject SQL if using PreferQueryMode=SIMPLE     (CVE-2024-1597)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 9 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - pgjdbc: PostgreSQL JDBC Driver allows attacker to inject SQL if using PreferQueryMode=SIMPLE     (CVE-2024-1597)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - pgjdbc: PostgreSQL JDBC Driver allows attacker to inject SQL if using PreferQueryMode=SIMPLE     (CVE-2024-1597)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-95837 advisory.

  - pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE. Note     this is not the default. In the default mode there is no vulnerability. A placeholder for a numeric value     must be immediately preceded by a minus. There must be a second placeholder for a string value after the     first placeholder; both must be on the same line. By constructing a matching string payload, the attacker     can inject SQL to alter the query,bypassing the protections that parameterized queries bring against SQL     Injection attacks. Versions before 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9, and 42.2.28 are affected.
    (CVE-2024-1597)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:3313 advisory.

    PostgreSQL is an advanced object-relational database management system. The     postgresql-jdbc package includes the .jar files needed for Java programs to     access a PostgreSQL database.

    Security Fix(es):

    * pgjdbc: PostgreSQL JDBC Driver allows attacker to inject SQL if using     PreferQueryMode=SIMPLE (CVE-2024-1597)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE page(s)     listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RLSA-2024:1436 advisory.

  - pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE. Note     this is not the default. In the default mode there is no vulnerability. A placeholder for a numeric value     must be immediately preceded by a minus. There must be a second placeholder for a string value after the     first placeholder; both must be on the same line. By constructing a matching string payload, the attacker     can inject SQL to alter the query,bypassing the protections that parameterized queries bring against SQL     Injection attacks. Versions before 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9, and 42.2.28 are affected.
    (CVE-2024-1597)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3812 advisory.

  - pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE. Note     this is not the default. In the default mode there is no vulnerability. A placeholder for a numeric value     must be immediately preceded by a minus. There must be a second placeholder for a string value after the     first placeholder; both must be on the same line. By constructing a matching string payload, the attacker     can inject SQL to alter the query,bypassing the protections that parameterized queries bring against SQL     Injection attacks. Versions before 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9, and 42.2.28 are affected.
    (CVE-2024-1597)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:2624 advisory.

    PostgreSQL is an advanced object-relational database management system. The     postgresql-jdbc package includes the .jar files needed for Java programs to     access a PostgreSQL database.

    Security Fix(es):

    * pgjdbc: PostgreSQL JDBC Driver allows attacker to inject SQL if using     PreferQueryMode=SIMPLE (CVE-2024-1597)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References     section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-ed884c3203 advisory.

    This rebase fixes CVE-2024-1597.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:1999 advisory.

    PostgreSQL is an advanced object-relational database management system. The postgresql-jdbc package     includes the .jar files needed for Java programs to access a PostgreSQL database.

    Security Fix(es):

    * pgjdbc: PostgreSQL JDBC Driver allows attacker to inject SQL if using     PreferQueryMode=SIMPLE (CVE-2024-1597)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:1649 advisory.

    PostgreSQL is an advanced object-relational database management system. The     postgresql-jdbc package includes the .jar files needed for Java programs to     access a PostgreSQL database.

    Security Fix(es):

    * pgjdbc: PostgreSQL JDBC Driver allows attacker to inject SQL if using PreferQueryMode=SIMPLE     (CVE-2024-1597)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References     section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2024:1435 advisory.

  - pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE. Note     this is not the default. In the default mode there is no vulnerability. A placeholder for a numeric value     must be immediately preceded by a minus. There must be a second placeholder for a string value after the     first placeholder; both must be on the same line. By constructing a matching string payload, the attacker     can inject SQL to alter the query,bypassing the protections that parameterized queries bring against SQL     Injection attacks. Versions before 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9, and 42.2.8 are affected.
    (CVE-2024-1597)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-1435 advisory.

    [42.2.14-3]
    - Fix CVE-2024-1597

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2024:1435 advisory.

  - pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE. Note     this is not the default. In the default mode there is no vulnerability. A placeholder for a numeric value     must be immediately preceded by a minus. There must be a second placeholder for a string value after the     first placeholder; both must be on the same line. By constructing a matching string payload, the attacker     can inject SQL to alter the query,bypassing the protections that parameterized queries bring against SQL     Injection attacks. Versions before 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9, and 42.2.8 are affected.
    (CVE-2024-1597)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2024:1436 advisory.

  - pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE. Note     this is not the default. In the default mode there is no vulnerability. A placeholder for a numeric value     must be immediately preceded by a minus. There must be a second placeholder for a string value after the     first placeholder; both must be on the same line. By constructing a matching string payload, the attacker     can inject SQL to alter the query,bypassing the protections that parameterized queries bring against SQL     Injection attacks. Versions before 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9, and 42.2.8 are affected.
    (CVE-2024-1597)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2024-1436 advisory.

    [42.2.28-1]
    - rebase to 42.2.28
    - fix for CVE-2024-1597

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2024:1435 advisory.

  - pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE. Note     this is not the default. In the default mode there is no vulnerability. A placeholder for a numeric value     must be immediately preceded by a minus. There must be a second placeholder for a string value after the     first placeholder; both must be on the same line. By constructing a matching string payload, the attacker     can inject SQL to alter the query,bypassing the protections that parameterized queries bring against SQL     Injection attacks. Versions before 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9, and 42.2.8 are affected.
    (CVE-2024-1597)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:1436 advisory.

    PostgreSQL is an advanced object-relational database management system. The postgresql-jdbc package     includes the .jar files needed for Java programs to access a PostgreSQL database.

    Security Fix(es):

    * PostgreSQL JDBC Driver allows attacker to inject SQL if using PreferQueryMode=SIMPLE (CVE-2024-1597)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:1435 advisory.

    PostgreSQL is an advanced object-relational database management system. The postgresql-jdbc package     includes the .jar files needed for Java programs to access a PostgreSQL database.

    Security Fix(es):

    * PostgreSQL JDBC Driver allows attacker to inject SQL if using PreferQueryMode=SIMPLE (CVE-2024-1597)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2024:0771-1 advisory.

  - pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE. Note     this is not the default. In the default mode there is no vulnerability. A placeholder for a numeric value     must be immediately preceded by a minus. There must be a second placeholder for a string value after the     first placeholder; both must be on the same line. By constructing a matching string payload, the attacker     can inject SQL to alter the query,bypassing the protections that parameterized queries bring against SQL     Injection attacks. Versions before 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9, and 42.2.8 are affected.
    (CVE-2024-1597)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2024:0769-1 advisory.

  - pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE. Note     this is not the default. In the default mode there is no vulnerability. A placeholder for a numeric value     must be immediately preceded by a minus. There must be a second placeholder for a string value after the     first placeholder; both must be on the same line. By constructing a matching string payload, the attacker     can inject SQL to alter the query,bypassing the protections that parameterized queries bring against SQL     Injection attacks. Versions before 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9, and 42.2.8 are affected.
    (CVE-2024-1597)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:0773-1 advisory.

  - pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE. Note     this is not the default. In the default mode there is no vulnerability. A placeholder for a numeric value     must be immediately preceded by a minus. There must be a second placeholder for a string value after the     first placeholder; both must be on the same line. By constructing a matching string payload, the attacker     can inject SQL to alter the query,bypassing the protections that parameterized queries bring against SQL     Injection attacks. Versions before 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9, and 42.2.8 are affected.
    (CVE-2024-1597)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
202014	RHEL 8 : postgresql-jdbc (RHSA-2024:4402)	Nessus	Red Hat Local Security Checks	critical
201957	RHEL 8 : postgresql-jdbc (RHSA-2024:4375)	Nessus	Red Hat Local Security Checks	critical
199927	RHEL 8 : pgjdbc (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
199874	RHEL 9 : pgjdbc (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
199826	RHEL 6 : pgjdbc (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
197936	Atlassian Confluence 6.0.1 < 7.19.22 / 7.20.x < 8.5.9 / 8.6.x < 8.9.1 SQLI (CONFSERVER-95837)	Nessus	CGI abuses	critical
197731	RHEL 8 : postgresql-jdbc (RHSA-2024:3313)	Nessus	Red Hat Local Security Checks	critical
196970	Rocky Linux 9 : postgresql-jdbc (RLSA-2024:1436)	Nessus	Rocky Linux Local Security Checks	critical
196700	RHEL 8 : pgjdbc (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
196684	RHEL 9 : pgjdbc (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
195297	Debian dla-3812 : libpostgresql-jdbc-java - security update	Nessus	Debian Local Security Checks	critical
194835	RHEL 8 : postgresql-jdbc : Security Update (Important) (RHSA-2024:2624)	Nessus	Red Hat Local Security Checks	critical
194680	Fedora 40 : postgresql-jdbc (2024-ed884c3203)	Nessus	Fedora Local Security Checks	critical
193802	RHEL 9 : postgresql-jdbc (RHSA-2024:1999)	Nessus	Red Hat Local Security Checks	critical
192865	RHEL 9 : postgresql-jdbc: (RHSA-2024:1649)	Nessus	Red Hat Local Security Checks	critical
192612	Rocky Linux 8 : postgresql-jdbc (RLSA-2024:1435)	Nessus	Rocky Linux Local Security Checks	critical
192463	Oracle Linux 8 : postgresql-jdbc (ELSA-2024-1435)	Nessus	Oracle Linux Local Security Checks	critical
192400	AlmaLinux 8 : postgresql-jdbc (ALSA-2024:1435)	Nessus	Alma Linux Local Security Checks	critical
192394	AlmaLinux 9 : postgresql-jdbc (ALSA-2024:1436)	Nessus	Alma Linux Local Security Checks	critical
192316	Oracle Linux 9 : postgresql-jdbc (ELSA-2024-1436)	Nessus	Oracle Linux Local Security Checks	critical
192305	CentOS 8 : postgresql-jdbc (CESA-2024:1435)	Nessus	CentOS Local Security Checks	critical
192302	RHEL 9 : postgresql-jdbc (RHSA-2024:1436)	Nessus	Red Hat Local Security Checks	critical
192300	RHEL 8 : postgresql-jdbc (RHSA-2024:1435)	Nessus	Red Hat Local Security Checks	critical
191701	SUSE SLES12 Security Update : postgresql-jdbc (SUSE-SU-2024:0771-1)	Nessus	SuSE Local Security Checks	critical
191643	SUSE SLES15 Security Update : postgresql-jdbc (SUSE-SU-2024:0769-1)	Nessus	SuSE Local Security Checks	critical
191625	SUSE SLES15 / openSUSE 15 Security Update : postgresql-jdbc (SUSE-SU-2024:0773-1)	Nessus	SuSE Local Security Checks	critical

Detections

Analytics

CVE-2024-1597

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical