You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues-all@impala.apache.org by "Pranav Yogi Lodha (Jira)" <ji...@apache.org> on 2024/06/25 18:32:00 UTC
[jira] [Updated] (IMPALA-13180) Upgrade postgresql to 42.5.5
[ https://issues.apache.org/jira/browse/IMPALA-13180?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Pranav Yogi Lodha updated IMPALA-13180:
---------------------------------------
Summary: Upgrade postgresql to 42.5.5 (was: Upgrade postgresql to 42.5.5 due to CVE-2024-1597)
> Upgrade postgresql to 42.5.5
> ----------------------------
>
> Key: IMPALA-13180
> URL: https://issues.apache.org/jira/browse/IMPALA-13180
> Project: IMPALA
> Issue Type: Task
> Reporter: Pranav Yogi Lodha
> Assignee: Pranav Yogi Lodha
> Priority: Major
>
> Upgrade postgresql to 42.5.5 due to CVE-2024-1597
> Affected versions of this package are vulnerable to SQL Injection when using {{{}PreferQueryMode=SIMPLE{}}}, which is not the default setting. By passing in a numeric value placeholder immediately preceded by a minus and followed by a second placeholder for a string value, on the same line, an attacker can construct a payload that alters the parameterized query into which it is interpolated. This effectively bypasses the protections against SQL Injection that parameterized queries offer.
> [https://security.snyk.io/vuln/SNYK-JAVA-ORGPOSTGRESQL-6252740]
> [https://github.com/advisories/GHSA-24rp-q3w6-vc56]
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-all-unsubscribe@impala.apache.org
For additional commands, e-mail: issues-all-help@impala.apache.org