{ "dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": { "cveId": "CVE-2024-32655", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-04-16T14:15:26.877Z", "datePublished": "2024-05-09T14:29:14.067Z", "dateUpdated": "2024-08-02T02:13:40.451Z" }, "containers": { "cna": { "title": "Npgsql Vulnerable to SQL Injection via Protocol Message Size Overflow", "problemTypes": [ { "descriptions": [ { "cweId": "CWE-190", "lang": "en", "description": "CWE-190: Integer Overflow or Wraparound", "type": "CWE" } ] }, { "descriptions": [ { "cweId": "CWE-89", "lang": "en", "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "type": "CWE" } ] } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" } } ], "references": [ { "name": "https://github.com/npgsql/npgsql/security/advisories/GHSA-x9vc-6hfv-hg8c", "tags": [ "x_refsource_CONFIRM" ], "url": "https://github.com/npgsql/npgsql/security/advisories/GHSA-x9vc-6hfv-hg8c" }, { "name": "https://github.com/npgsql/npgsql/commit/091655eed0c84e502ab424950c930339d17c1928", "tags": [ "x_refsource_MISC" ], "url": "https://github.com/npgsql/npgsql/commit/091655eed0c84e502ab424950c930339d17c1928" }, { "name": "https://github.com/npgsql/npgsql/commit/3183efb2bdcca159c8c2e22af57e18ea8f853cf0", "tags": [ "x_refsource_MISC" ], "url": "https://github.com/npgsql/npgsql/commit/3183efb2bdcca159c8c2e22af57e18ea8f853cf0" }, { "name": "https://github.com/npgsql/npgsql/commit/67acbe027e28477ac2199e15cfb554bb2ffaf169", "tags": [ "x_refsource_MISC" ], "url": "https://github.com/npgsql/npgsql/commit/67acbe027e28477ac2199e15cfb554bb2ffaf169" }, { "name": "https://github.com/npgsql/npgsql/commit/703d9af8fa48dfe8c0180e36edb8278f34342d7b", "tags": [ "x_refsource_MISC" ], "url": "https://github.com/npgsql/npgsql/commit/703d9af8fa48dfe8c0180e36edb8278f34342d7b" }, { "name": "https://github.com/npgsql/npgsql/commit/a22a42d8141d7a3528f43c02c095a409507cf1af", "tags": [ "x_refsource_MISC" ], "url": "https://github.com/npgsql/npgsql/commit/a22a42d8141d7a3528f43c02c095a409507cf1af" }, { "name": "https://github.com/npgsql/npgsql/commit/e34e2ba8042e666d9af54a1b255fba4d5b11df56", "tags": [ "x_refsource_MISC" ], "url": "https://github.com/npgsql/npgsql/commit/e34e2ba8042e666d9af54a1b255fba4d5b11df56" }, { "name": "https://github.com/npgsql/npgsql/commit/f7e7ead0702d776a8f551f5786c4cac2d65c4bc6", "tags": [ "x_refsource_MISC" ], "url": "https://github.com/npgsql/npgsql/commit/f7e7ead0702d776a8f551f5786c4cac2d65c4bc6" }, { "name": "https://github.com/npgsql/npgsql/releases/tag/v4.0.14", "tags": [ "x_refsource_MISC" ], "url": "https://github.com/npgsql/npgsql/releases/tag/v4.0.14" }, { "name": "https://github.com/npgsql/npgsql/releases/tag/v4.1.13", "tags": [ "x_refsource_MISC" ], "url": "https://github.com/npgsql/npgsql/releases/tag/v4.1.13" }, { "name": "https://github.com/npgsql/npgsql/releases/tag/v5.0.18", "tags": [ "x_refsource_MISC" ], "url": "https://github.com/npgsql/npgsql/releases/tag/v5.0.18" }, { "name": "https://github.com/npgsql/npgsql/releases/tag/v6.0.11", "tags": [ "x_refsource_MISC" ], "url": "https://github.com/npgsql/npgsql/releases/tag/v6.0.11" }, { "name": "https://github.com/npgsql/npgsql/releases/tag/v7.0.7", "tags": [ "x_refsource_MISC" ], "url": "https://github.com/npgsql/npgsql/releases/tag/v7.0.7" }, { "name": "https://github.com/npgsql/npgsql/releases/tag/v8.0.3", "tags": [ "x_refsource_MISC" ], "url": "https://github.com/npgsql/npgsql/releases/tag/v8.0.3" } ], "affected": [ { "vendor": "npgsql", "product": "npgsql", "versions": [ { "version": ">= 4.0.0, < 4.0.14", "status": "affected" }, { "version": ">= 4.1.0, < 4.1.13", "status": "affected" }, { "version": ">= 5.0.0, < 5.0.18", "status": "affected" }, { "version": ">= 6.0.0, < 6.0.11", "status": "affected" }, { "version": ">= 7.0.0, < 7.0.7", "status": "affected" }, { "version": ">= 8.0.0, < 8.0.3", "status": "affected" } ] } ], "providerMetadata": { "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-05-10T15:04:59.679Z" }, "descriptions": [ { "lang": "en", "value": "Npgsql is the .NET data provider for PostgreSQL. The `WriteBind()` method in `src/Npgsql/Internal/NpgsqlConnector.FrontendMessages.cs` uses `int` variables to store the message length and the sum of parameter lengths. Both variables overflow when the sum of parameter lengths becomes too large. This causes Npgsql to write a message size that is too small when constructing a Postgres protocol message to send it over the network to the database. When parsing the message, the database will only read a small number of bytes and treat any following bytes as new messages while they belong to the old message. Attackers can abuse this to inject arbitrary Postgres protocol messages into the connection, leading to the execution of arbitrary SQL statements on the application's behalf. This vulnerability is fixed in 4.0.14, 4.1.13, 5.0.18, 6.0.11, 7.0.7, and 8.0.3." } ], "source": { "advisory": "GHSA-x9vc-6hfv-hg8c", "discovery": "UNKNOWN" } }, "adp": [ { "title": "CISA ADP Vulnrichment", "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2024-32655", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "yes" }, { "Technical Impact": "total" } ], "version": "2.0.3", "timestamp": "2024-05-09T17:34:05.971656Z" } } } ], "affected": [ { "cpes": [ "cpe:2.3:a:npgsql:npgsql:4.0.0:*:*:*:*:*:*:*" ], "vendor": "npgsql", "product": "npgsql", "versions": [ { "status": "affected", "version": "4.0.0", "lessThan": "4.0.14", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "cpes": [ "cpe:2.3:a:npgsql:npgsql:4.1.0:*:*:*:*:*:*:*" ], "vendor": "npgsql", "product": "npgsql", "versions": [ { "status": "affected", "version": "4.1.0", "lessThan": "4.1.13", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "cpes": [ "cpe:2.3:a:npgsql:npgsql:5.0.0:*:*:*:*:*:*:*" ], "vendor": "npgsql", "product": "npgsql", "versions": [ { "status": "affected", "version": "5.0.0", "lessThan": "5.0.18", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "cpes": [ "cpe:2.3:a:npgsql:npgsql:6.0.0:*:*:*:*:*:*:*" ], "vendor": "npgsql", "product": "npgsql", "versions": [ { "status": "affected", "version": "6.0.0", "lessThan": "6.0.11", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "cpes": [ "cpe:2.3:a:npgsql:npgsql:7.0.0:*:*:*:*:*:*:*" ], "vendor": "npgsql", "product": "npgsql", "versions": [ { "status": "affected", "version": "7.0.0", "lessThan": "8.0.3", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "cpes": [ "cpe:2.3:a:npgsql:npgsql:8.0.0:*:*:*:*:*:*:*" ], "vendor": "npgsql", "product": "npgsql", "versions": [ { "status": "affected", "version": "8.0.0", "lessThan": "8.0.3", "versionType": "custom" } ], "defaultStatus": "unknown" } ], "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:51:31.835Z" } }, { "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T02:13:40.451Z" }, "title": "CVE Program Container", "references": [ { "name": "https://github.com/npgsql/npgsql/security/advisories/GHSA-x9vc-6hfv-hg8c", "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://github.com/npgsql/npgsql/security/advisories/GHSA-x9vc-6hfv-hg8c" }, { "name": "https://github.com/npgsql/npgsql/commit/091655eed0c84e502ab424950c930339d17c1928", "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://github.com/npgsql/npgsql/commit/091655eed0c84e502ab424950c930339d17c1928" }, { "name": "https://github.com/npgsql/npgsql/commit/3183efb2bdcca159c8c2e22af57e18ea8f853cf0", "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://github.com/npgsql/npgsql/commit/3183efb2bdcca159c8c2e22af57e18ea8f853cf0" }, { "name": "https://github.com/npgsql/npgsql/commit/67acbe027e28477ac2199e15cfb554bb2ffaf169", "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://github.com/npgsql/npgsql/commit/67acbe027e28477ac2199e15cfb554bb2ffaf169" }, { "name": "https://github.com/npgsql/npgsql/commit/703d9af8fa48dfe8c0180e36edb8278f34342d7b", "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://github.com/npgsql/npgsql/commit/703d9af8fa48dfe8c0180e36edb8278f34342d7b" }, { "name": "https://github.com/npgsql/npgsql/commit/a22a42d8141d7a3528f43c02c095a409507cf1af", "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://github.com/npgsql/npgsql/commit/a22a42d8141d7a3528f43c02c095a409507cf1af" }, { "name": "https://github.com/npgsql/npgsql/commit/e34e2ba8042e666d9af54a1b255fba4d5b11df56", "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://github.com/npgsql/npgsql/commit/e34e2ba8042e666d9af54a1b255fba4d5b11df56" }, { "name": "https://github.com/npgsql/npgsql/commit/f7e7ead0702d776a8f551f5786c4cac2d65c4bc6", "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://github.com/npgsql/npgsql/commit/f7e7ead0702d776a8f551f5786c4cac2d65c4bc6" }, { "name": "https://github.com/npgsql/npgsql/releases/tag/v4.0.14", "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://github.com/npgsql/npgsql/releases/tag/v4.0.14" }, { "name": "https://github.com/npgsql/npgsql/releases/tag/v4.1.13", "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://github.com/npgsql/npgsql/releases/tag/v4.1.13" }, { "name": "https://github.com/npgsql/npgsql/releases/tag/v5.0.18", "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://github.com/npgsql/npgsql/releases/tag/v5.0.18" }, { "name": "https://github.com/npgsql/npgsql/releases/tag/v6.0.11", "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://github.com/npgsql/npgsql/releases/tag/v6.0.11" }, { "name": "https://github.com/npgsql/npgsql/releases/tag/v7.0.7", "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://github.com/npgsql/npgsql/releases/tag/v7.0.7" }, { "name": "https://github.com/npgsql/npgsql/releases/tag/v8.0.3", "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://github.com/npgsql/npgsql/releases/tag/v8.0.3" } ] } ] } }