{
  "threat_severity" : "Moderate",
  "public_date" : "2024-03-07T00:00:00Z",
  "bugzilla" : {
    "description" : "pgx: SQL Injection via Line Comment Creation",
    "id" : "2268465",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2268465"
  },
  "cvss3" : {
    "cvss3_base_score" : "8.1",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-89",
  "details" : [ "pgx is a PostgreSQL driver and toolkit for Go. Prior to version 4.18.2, SQL injection can occur when all of the following conditions are met: the non-default simple protocol is used; a placeholder for a numeric value must be immediately preceded by a minus; there must be a second placeholder for a string value after the first placeholder; both must be on the same line; and both parameter values must be user-controlled. The problem is resolved in v4.18.2. As a workaround, do not use the simple protocol or do not place a minus directly before a placeholder.", "A flaw was found in pgx. SQL injection can occur when all of the following conditions are met in versions before 4.18.2 of pgx. \n- The non-default simple protocol is used\n- A placeholder for a numeric value must be immediately preceded by a minus\n- There must be a second placeholder for a string value after the first placeholder\n- Both must be on the same line\n- Both parameter values must be user-controlled" ],
  "affected_release" : [ {
    "product_name" : "Red Hat Advanced Cluster Security 4.3",
    "release_date" : "2024-03-13T00:00:00Z",
    "advisory" : "RHSA-2024:1321",
    "cpe" : "cpe:/a:redhat:advanced_cluster_security:4.3::el8",
    "package" : "advanced-cluster-security/rhacs-central-db-rhel8:4.3.5-3"
  }, {
    "product_name" : "Red Hat Advanced Cluster Security 4.3",
    "release_date" : "2024-03-13T00:00:00Z",
    "advisory" : "RHSA-2024:1321",
    "cpe" : "cpe:/a:redhat:advanced_cluster_security:4.3::el8",
    "package" : "advanced-cluster-security/rhacs-collector-rhel8:4.3.5-3"
  }, {
    "product_name" : "Red Hat Advanced Cluster Security 4.3",
    "release_date" : "2024-03-13T00:00:00Z",
    "advisory" : "RHSA-2024:1321",
    "cpe" : "cpe:/a:redhat:advanced_cluster_security:4.3::el8",
    "package" : "advanced-cluster-security/rhacs-collector-slim-rhel8:4.3.5-1"
  }, {
    "product_name" : "Red Hat Advanced Cluster Security 4.3",
    "release_date" : "2024-03-13T00:00:00Z",
    "advisory" : "RHSA-2024:1321",
    "cpe" : "cpe:/a:redhat:advanced_cluster_security:4.3::el8",
    "package" : "advanced-cluster-security/rhacs-main-rhel8:4.3.5-4"
  }, {
    "product_name" : "Red Hat Advanced Cluster Security 4.3",
    "release_date" : "2024-03-13T00:00:00Z",
    "advisory" : "RHSA-2024:1321",
    "cpe" : "cpe:/a:redhat:advanced_cluster_security:4.3::el8",
    "package" : "advanced-cluster-security/rhacs-operator-bundle:4.3.5-4"
  }, {
    "product_name" : "Red Hat Advanced Cluster Security 4.3",
    "release_date" : "2024-03-13T00:00:00Z",
    "advisory" : "RHSA-2024:1321",
    "cpe" : "cpe:/a:redhat:advanced_cluster_security:4.3::el8",
    "package" : "advanced-cluster-security/rhacs-rhel8-operator:4.3.5-3"
  }, {
    "product_name" : "Red Hat Advanced Cluster Security 4.3",
    "release_date" : "2024-03-13T00:00:00Z",
    "advisory" : "RHSA-2024:1321",
    "cpe" : "cpe:/a:redhat:advanced_cluster_security:4.3::el8",
    "package" : "advanced-cluster-security/rhacs-roxctl-rhel8:4.3.5-3"
  }, {
    "product_name" : "Red Hat Advanced Cluster Security 4.3",
    "release_date" : "2024-03-13T00:00:00Z",
    "advisory" : "RHSA-2024:1321",
    "cpe" : "cpe:/a:redhat:advanced_cluster_security:4.3::el8",
    "package" : "advanced-cluster-security/rhacs-scanner-db-rhel8:4.3.5-3"
  }, {
    "product_name" : "Red Hat Advanced Cluster Security 4.3",
    "release_date" : "2024-03-13T00:00:00Z",
    "advisory" : "RHSA-2024:1321",
    "cpe" : "cpe:/a:redhat:advanced_cluster_security:4.3::el8",
    "package" : "advanced-cluster-security/rhacs-scanner-db-slim-rhel8:4.3.5-1"
  }, {
    "product_name" : "Red Hat Advanced Cluster Security 4.3",
    "release_date" : "2024-03-13T00:00:00Z",
    "advisory" : "RHSA-2024:1321",
    "cpe" : "cpe:/a:redhat:advanced_cluster_security:4.3::el8",
    "package" : "advanced-cluster-security/rhacs-scanner-rhel8:4.3.5-3"
  }, {
    "product_name" : "Red Hat Advanced Cluster Security 4.3",
    "release_date" : "2024-03-13T00:00:00Z",
    "advisory" : "RHSA-2024:1321",
    "cpe" : "cpe:/a:redhat:advanced_cluster_security:4.3::el8",
    "package" : "advanced-cluster-security/rhacs-scanner-slim-rhel8:4.3.5-3"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4.16",
    "release_date" : "2024-10-16T00:00:00Z",
    "advisory" : "RHSA-2024:7944",
    "cpe" : "cpe:/a:redhat:openshift:4.16::el9",
    "package" : "openshift4/ose-agent-installer-csr-approver-rhel9:v4.16.0-202410031007.p0.g342902b.assembly.stream.el9"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4.17",
    "release_date" : "2024-10-16T00:00:00Z",
    "advisory" : "RHSA-2024:7922",
    "cpe" : "cpe:/a:redhat:openshift:4.17::el9",
    "package" : "openshift4/ose-agent-installer-csr-approver-rhel9:v4.17.0-202410031034.p0.gfbc55c6.assembly.stream.el9"
  } ],
  "package_state" : [ {
    "product_name" : "Multicluster Engine for Kubernetes",
    "fix_state" : "Affected",
    "package_name" : "multicluster-engine/agent-service-rhel8",
    "cpe" : "cpe:/a:redhat:multicluster_engine"
  }, {
    "product_name" : "Multicluster Engine for Kubernetes",
    "fix_state" : "Affected",
    "package_name" : "multicluster-engine/assisted-installer-agent-rhel9",
    "cpe" : "cpe:/a:redhat:multicluster_engine"
  }, {
    "product_name" : "Multicluster Engine for Kubernetes",
    "fix_state" : "Not affected",
    "package_name" : "multicluster-engine/assisted-installer-reporter-rhel8",
    "cpe" : "cpe:/a:redhat:multicluster_engine"
  }, {
    "product_name" : "Multicluster Engine for Kubernetes",
    "fix_state" : "Will not fix",
    "package_name" : "multicluster-engine/assisted-installer-rhel8",
    "cpe" : "cpe:/a:redhat:multicluster_engine"
  }, {
    "product_name" : "Red Hat Advanced Cluster Management for Kubernetes 2",
    "fix_state" : "Not affected",
    "package_name" : "rhacm2/acm-search-indexer-rhel9",
    "cpe" : "cpe:/a:redhat:acm:2"
  }, {
    "product_name" : "Red Hat Advanced Cluster Management for Kubernetes 2",
    "fix_state" : "Not affected",
    "package_name" : "rhacm2/acm-search-v2-api-rhel9",
    "cpe" : "cpe:/a:redhat:acm:2"
  }, {
    "product_name" : "Red Hat Advanced Cluster Security 3",
    "fix_state" : "Out of support scope",
    "package_name" : "advanced-cluster-security/rhacs-central-db-rhel8",
    "cpe" : "cpe:/a:redhat:advanced_cluster_security:3"
  }, {
    "product_name" : "Red Hat Advanced Cluster Security 3",
    "fix_state" : "Will not fix",
    "package_name" : "advanced-cluster-security/rhacs-main-rhel8",
    "cpe" : "cpe:/a:redhat:advanced_cluster_security:3"
  }, {
    "product_name" : "Red Hat Advanced Cluster Security 3",
    "fix_state" : "Out of support scope",
    "package_name" : "advanced-cluster-security/rhacs-rhel8-operator",
    "cpe" : "cpe:/a:redhat:advanced_cluster_security:3"
  }, {
    "product_name" : "Red Hat Advanced Cluster Security 3",
    "fix_state" : "Out of support scope",
    "package_name" : "advanced-cluster-security/rhacs-roxctl-rhel8",
    "cpe" : "cpe:/a:redhat:advanced_cluster_security:3"
  }, {
    "product_name" : "Red Hat Ansible Automation Platform 2",
    "fix_state" : "Will not fix",
    "package_name" : "aap-cloud-ui-container",
    "cpe" : "cpe:/a:redhat:ansible_automation_platform:2"
  }, {
    "product_name" : "Red Hat Enterprise Linux 10",
    "fix_state" : "Affected",
    "package_name" : "osbuild-composer",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Will not fix",
    "package_name" : "osbuild-composer",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Will not fix",
    "package_name" : "osbuild-composer",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "openshift4/ose-agent-installer-api-server-rhel9",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "openshift4/ose-agent-installer-node-agent-rhel9",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform Assisted Installer 1",
    "fix_state" : "Affected",
    "package_name" : "rhai-tech-preview/assisted-installer-agent-rhel8",
    "cpe" : "cpe:/a:redhat:assisted_installer:1"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform Assisted Installer 1",
    "fix_state" : "Affected",
    "package_name" : "rhai-tech-preview/assisted-installer-rhel8",
    "cpe" : "cpe:/a:redhat:assisted_installer:1"
  }, {
    "product_name" : "Red Hat OpenStack Platform 16.2",
    "fix_state" : "Not affected",
    "package_name" : "osp-director-provisioner-container",
    "cpe" : "cpe:/a:redhat:openstack:16.2"
  }, {
    "product_name" : "Red Hat Quay 3",
    "fix_state" : "Affected",
    "package_name" : "quay/clair-rhel8",
    "cpe" : "cpe:/a:redhat:quay:3"
  }, {
    "product_name" : "Red Hat Quay 3",
    "fix_state" : "Affected",
    "package_name" : "quay/quay-operator-rhel8",
    "cpe" : "cpe:/a:redhat:quay:3"
  }, {
    "product_name" : "Red Hat Quay 3",
    "fix_state" : "Affected",
    "package_name" : "quay/quay-rhel8",
    "cpe" : "cpe:/a:redhat:quay:3"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2024-27289\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-27289\nhttps://github.com/jackc/pgx/commit/f94eb0e2f96782042c96801b5ac448f44f0a81df\nhttps://github.com/jackc/pgx/security/advisories/GHSA-m7wr-2xf7-cm9p\nhttps://pkg.go.dev/vuln/GO-2024-2605" ],
  "name" : "CVE-2024-27289",
  "mitigation" : {
    "value" : "A possible mitigation is to not use the simple protocol or do not place a minus directly before a placeholder.",
    "lang" : "en:us"
  },
  "csaw" : false
}