Bug 33051 - postgresql-jdbc new security issue CVE-2024-1597
Summary: postgresql-jdbc new security issue CVE-2024-1597
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 9
Hardware: All Linux
Priority: Normal critical
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA9-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2024-04-03 14:42 CEST by Nicolas Salguero
Modified: 2024-04-12 01:59 CEST (History)
4 users (show)

See Also:
Source RPM: postgresql-jdbc-42.5.1-1.mga9.src.rpm
CVE: CVE-2024-1597
Status comment:


Attachments
really basic java connect to postgres (Java 17) (1.14 KB, text/x-csrc)
2024-04-11 04:56 CEST, Brian Rockwell
Details

Description Nicolas Salguero 2024-04-03 14:42:41 CEST
That CVE was announced here:
https://www.openwall.com/lists/oss-security/2024/04/02/6

It is fixed in versions 42.7.2 (for Cauldron, I think it is better to upgrade to 42.7.3) and 42.5.5 (for Mageia 9).

Mageia 9 is also affected.
Nicolas Salguero 2024-04-03 14:43:18 CEST

Status comment: (none) => Fixed upstream in 42.7.2 and 42.5.5
Whiteboard: (none) => MGA9TOO
CVE: (none) => CVE-2024-1597
Source RPM: (none) => postgresql-jdbc-42.7.1-1.mga10.src.rpm

Comment 1 Nicolas Salguero 2024-04-03 15:25:47 CEST
Suggested advisory:
========================

The updated packages fix a security vulnerability:

pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE. Note this is not the default. In the default mode there is no vulnerability. A placeholder for a numeric value must be immediately preceded by a minus. There must be a second placeholder for a string value after the first placeholder; both must be on the same line. By constructing a matching string payload, the attacker can inject SQL to alter the query,bypassing the protections that parameterized queries bring against SQL Injection attacks. (CVE-2024-1597)

References:
https://www.openwall.com/lists/oss-security/2024/04/02/6
========================

Updated packages in core/updates_testing:
========================
postgresql-jdbc-42.5.6-1.mga9
postgresql-jdbc-javadoc-42.5.6-1.mga9

from SRPM:
postgresql-jdbc-42.5.6-1.mga9.src.rpm

Source RPM: postgresql-jdbc-42.7.1-1.mga10.src.rpm => postgresql-jdbc-42.5.1-1.mga9.src.rpm
Whiteboard: MGA9TOO => (none)
Version: Cauldron => 9
Assignee: bugsquad => qa-bugs
Status: NEW => ASSIGNED
Status comment: Fixed upstream in 42.7.2 and 42.5.5 => (none)

katnatek 2024-04-03 19:33:41 CEST

Keywords: (none) => advisory

Comment 2 Herman Viaene 2024-04-04 17:19:45 CEST
MGA-64 Plasma Wayland on HP-Pavillion
No installation issues
Ref bug 27017 for testing, but I have no idea what is Brian's "piece of code" is.
Googled for an example, found https://mkyong.com/jdbc/how-do-connect-to-postgresql-with-jdbc-driver-java/
Edited the example to connect to my postgres on my desktop, but got (as in the example):
$ java JDBCExample
SQL State: 08001
No suitable driver found for jdbc:postgresql .....etc
Tried  manual loading
$ java -cp /usr/share/java/postgresql.jar JDBCExample
Error: Could not find or load main class JDBCExample
Caused by: java.lang.ClassNotFoundException: JDBCExample
I have no idea why that is????

CC: (none) => herman.viaene

Comment 3 katnatek 2024-04-05 05:09:58 CEST
(In reply to Herman Viaene from comment #2)
> MGA-64 Plasma Wayland on HP-Pavillion
> No installation issues
> Ref bug 27017 for testing, but I have no idea what is Brian's "piece of
> code" is.
> Googled for an example, found
> https://mkyong.com/jdbc/how-do-connect-to-postgresql-with-jdbc-driver-java/
> Edited the example to connect to my postgres on my desktop, but got (as in
> the example):
> $ java JDBCExample
> SQL State: 08001
> No suitable driver found for jdbc:postgresql .....etc
> Tried  manual loading
> $ java -cp /usr/share/java/postgresql.jar JDBCExample
> Error: Could not find or load main class JDBCExample
> Caused by: java.lang.ClassNotFoundException: JDBCExample
> I have no idea why that is????

Sorry if again I make an obvious question, did you have java-17-openjdk-headless ?

I find this https://stackoverflow.com/questions/18093928/what-does-could-not-find-or-load-main-class-mean/18093929#18093929 very large explanation about the issue, I hope it helps to you
Comment 4 Herman Viaene 2024-04-05 14:12:37 CEST
Yes, it is installed, and I tried to nget any wiser from that site, but gave up. Leaving for someone else.
katnatek 2024-04-05 19:25:23 CEST

CC: (none) => brtians1

Comment 5 katnatek 2024-04-05 19:26:34 CEST
Brian Rockwell can you please make the test for this bug, thank you
Comment 6 Brian Rockwell 2024-04-10 23:41:27 CEST
I'll look into it.  Hopefully still have the code.
Comment 7 Brian Rockwell 2024-04-11 04:54:17 CEST
jdbc driver

install postgres and start it
install new jdbc driver

su over to postgres
CREATE DATABASE m;
psql
create user mageia with password mageia5
/c m
GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public TO mageia;
CREATE TABLE cars (
  brand VARCHAR(255),
  model VARCHAR(255),
  year INT
); 
insert into cars (brand, model, year) values ('Honda', 'Insight', 2019);
select * from cars;  --this confirms the row is there

Now compile program using java 17

javac -cp /usr/share/java/postgresql.jar postMan.java
java -cp .:/usr/share/java/postgresql.jar postMan


I was able to get a successful connection

$ java -cp .:/usr/share/java/postgresql.jar postMan
Connection established successfully
Honda, Insight, 2019

(I'll attach code in a minute)
Comment 8 Brian Rockwell 2024-04-11 04:56:24 CEST
Created attachment 14497 [details]
really basic java connect to postgres (Java 17)
Brian Rockwell 2024-04-11 04:57:14 CEST

Whiteboard: (none) => MGA9-64-OK

katnatek 2024-04-12 00:51:50 CEST

CC: (none) => andrewsfarm

Comment 9 katnatek 2024-04-12 00:52:14 CEST
Thank you for the test Brian
Comment 10 Thomas Andrews 2024-04-12 00:56:56 CEST
Validating.

CC: (none) => sysadmin-bugs
Keywords: (none) => validated_update

Comment 11 Mageia Robot 2024-04-12 01:59:29 CEST
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2024-0120.html

Resolution: (none) => FIXED
Status: ASSIGNED => RESOLVED


Note You need to log in before you can comment on or make changes to this bug.